This vulnerability in DedeCMS up to version 5.7.118 UTF8SP2 involves the _4_Setup function of the install/index.php file in the Installation Wizard component. Improper input handling leads to a file inclusion flaw that can be triggered remotely. The attack requires high complexity and has low exploitability. The vulnerability is publicly disclosed but no official fix or patch information is provided in the available data. The CVSS 4.0 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation could allow an attacker to include arbitrary files on the affected system remotely, potentially leading to information disclosure or further compromise depending on the included files. However, the low CVSS score and high attack complexity suggest limited practical impact under typical conditions. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a patch is available, restricting access to the installation wizard and validating input parameters may help reduce risk.