CVE-2026-15700 is a path traversal vulnerability in DedeCMS 5.7.118 affecting the ExtractFile function in include/zip.class.php of the Album Publishing Feature. The vulnerability arises from improper validation of the filename argument, allowing remote attackers to traverse directories and potentially access unauthorized files. The vulnerability has been publicly disclosed with exploit code available, but no official fix or patch has been announced. The CVSS 4.0 vector indicates network attack vector, low complexity, no user interaction, and partial impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow remote attackers to read or write files outside the intended directory structure, potentially leading to unauthorized information disclosure or modification. The impact is rated medium with partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the vulnerable component and monitor for suspicious activity related to file extraction. Avoid exposing the vulnerable feature to untrusted users.