CVE-2026-15700 is a path traversal vulnerability affecting DedeCMS 5.7.118. The issue resides in the ExtractFile function of include/zip.class.php in the Album Publishing Feature component. By manipulating the filename argument, an attacker can perform path traversal, potentially accessing files outside the intended directory. The vulnerability is remotely exploitable and has been publicly disclosed with exploit code available. No official fix or patch has been confirmed by the vendor as of the published date.

Successful exploitation of this vulnerability could allow an attacker to read or write files outside the intended directory structure on the affected system, potentially leading to unauthorized access to sensitive files or system compromise. The CVSS score of 5.1 indicates a medium impact with network attack vector and low complexity. However, the attack requires high privileges (PR:H) and does not require user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable component and monitor for suspicious activity related to file extraction features. Avoid exposing the Album Publishing Feature to untrusted users or networks.