CVE-2026-30643

The vulnerability exploits the module upload mechanism in DedeCMS. An attacker can deliver a crafted module containing malicious tag values (setup tag values), which are then interpreted and executed by the application without proper validation. The lack of input sanitization leads to arbitrary code execution on the server side. The attack vector is network-based, requires no authentication or user interaction, making this vulnerability particularly dangerous.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely (RCE) on the server, which can lead to complete system compromise, data theft, backdoor installation, or further lateral movement within the infrastructure.

Apply patches available from the vendor according to the references. It is recommended to monitor updates on the official vendor website (dedecms.com) and — until the patch is deployed — restrict access to the module upload functionality exclusively to trusted, authenticated users, preferably at the firewall or network access control level.

DedeCMS version 5.7.118