CVE-2026-38615: DedeCMS V5

Synopsis

A command execution vulnerability exists in DedeCMS V5.7.118, specifically in the file_manage_control.php component. The flaw is reachable over the network with no authentication required and no user interaction needed, making it trivially exploitable by any remote attacker. Successful exploitation allows the attacker to execute arbitrary operating system commands on the host, leading to full confidentiality loss, data tampering, and service disruption. No fix version has been published; HarborGuard tracks the upstream advisory and will make a patched rebuild available as soon as one is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable component is exposed over the network; an attacker must be able to send HTTP requests to the DedeCMS instance to reach the file_manage_control.php endpoint.

• AuthenticationNot required

  No account or session credentials are needed; the attack is accessible to any unauthenticated remote party.

• Victim interactionNot required

  The attacker does not need to trick any user into taking an action; exploitation is fully attacker-driven.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites.

Blast Radius

• An attacker executes arbitrary operating system commands on the host running DedeCMS, gaining the same OS-level access as the web server process.
• All data stored by the application, including user credentials, content, and configuration files, is readable by the attacker.
• The attacker can modify or delete persisted application data, database records, and files on the host filesystem.
• The attacker can terminate processes or exhaust host resources, taking the DedeCMS service and potentially co-hosted services offline.