CVE-2026-10608 is a SQL injection vulnerability affecting DedeCMS 5.7.88. The issue is located in the RemoveXSS function of the /plus/carbuyaction.php file, where manipulation of the postname/des argument enables injection of SQL commands. The vulnerability can be exploited remotely without authentication or user interaction, with low complexity and limited scope of impact. The CVSS 4.0 vector indicates network attack vector, no privileges required, no user interaction, and low to limited impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL commands on the affected DedeCMS database, potentially leading to unauthorized data access or modification. The impact is rated medium severity based on the CVSS 4.0 score of 6.9. There is no evidence of known exploits in the wild at this time, but a public exploit has been released, increasing the risk of attack.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider implementing temporary mitigations such as input validation or web application firewall rules to block malicious payloads targeting the postname/des parameter. Monitor official DedeCMS channels for updates and apply patches promptly once available.