CVE-2026-19353: File Inclusion in DedeCMS
CVE-2026-19353 is a file inclusion vulnerability in DedeCMS affecting the Installation Wizard component, specifically the _4_Setup function in install/index.php. It allows remote attackers to include files via crafted input. The vulnerability has high attack complexity and is difficult to exploit. It has been publicly disclosed but no known exploits are reported in the wild. The CVSS 4.0 score is low (2.3).
AI Analysis
Technical Summary
DedeCMS up to version 5.7.118 UTF8SP2 contains a file inclusion vulnerability in the _4_Setup function of the install/index.php file within the Installation Wizard component. This flaw allows remote attackers to manipulate input to include arbitrary files, potentially leading to information disclosure or other impacts. The attack complexity is high, requiring specific conditions, and exploitability is difficult. The vulnerability has been publicly disclosed but no active exploitation is currently known.
Potential Impact
The vulnerability could allow remote attackers to include files on the server, which may lead to information disclosure or other impacts depending on the included files. However, the attack complexity is high and exploitability is difficult, limiting the likelihood of successful exploitation. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is indicated, users should monitor vendor communications for updates. Until a patch is available, restricting access to the installation wizard and validating input may reduce exposure.
CVE-2026-19353: File Inclusion in DedeCMS
Description
CVE-2026-19353 is a file inclusion vulnerability in DedeCMS affecting the Installation Wizard component, specifically the _4_Setup function in install/index.php. It allows remote attackers to include files via crafted input. The vulnerability has high attack complexity and is difficult to exploit. It has been publicly disclosed but no known exploits are reported in the wild. The CVSS 4.0 score is low (2.3).
CVSS v4.0
Score 2.3low
Affected software
cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:*AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
DedeCMS up to version 5.7.118 UTF8SP2 contains a file inclusion vulnerability in the _4_Setup function of the install/index.php file within the Installation Wizard component. This flaw allows remote attackers to manipulate input to include arbitrary files, potentially leading to information disclosure or other impacts. The attack complexity is high, requiring specific conditions, and exploitability is difficult. The vulnerability has been publicly disclosed but no active exploitation is currently known.
Potential Impact
The vulnerability could allow remote attackers to include files on the server, which may lead to information disclosure or other impacts depending on the included files. However, the attack complexity is high and exploitability is difficult, limiting the likelihood of successful exploitation. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is indicated, users should monitor vendor communications for updates. Until a patch is available, restricting access to the installation wizard and validating input may reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulDB
- Date Reserved
- 2026-08-08T17:39:05.274Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a787c9ebf8831d539a4d3e3
Added to database: 08/09/2026, 13:11:58 UTC
Last enriched: 08/09/2026, 13:48:48 UTC
Last updated: 08/09/2026, 13:48:48 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.