CVE-2026-19353— DedeCMS Installation Wizard index.php _4_Setup file inclusion
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-19353
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
DedeCMS Installation Wizard index.php _4_Setup file inclusion
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability has been found in DedeCMS up to 5.7.118 UTF8SP2. The affected element is the function _4_Setup of the file install/index.php of the component Installation Wizard. Such manipulation leads to file inclusion. The attack can be executed remotely. This attack is characterized by high complexity. The exploitability is described as difficult. The exploit has been disclosed to the public and may be used.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
文件名或路径的外部可控制
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | DedeCMS | 5.7.118 UTF8SP2 | cpe:2.3:a:dedecms:dedecms:*:*:*:*:*:*:*:* |
II. Public POCs for CVE-2026-19353
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19353
请登录查看更多情报信息。
Other References for CVE-2026-19353 (1)
IV. Related Vulnerabilities
Same product: DedeCMS
- CVE-2026-15700
DedeCMS Album Publishing Feature zip.class.php ExtractFile p - CVE-2026-15533
DedeCMS Column Management search.php code injection - CVE-2026-10608
DedeCMS carbuyaction.php RemoveXSS sql injection - CVE-2026-10607
DedeCMS flink.php dede_htmlspecialchars sql injection - CVE-2026-10606
DedeCMS Feedback feedback.php TrimMsg sql injection
Same vendor: n/a
Same weakness: CWE-73
- CVE-2026-54200
TeamDavid: Local File Inclusion via the form field 'scjob' - CVE-2026-12070
TeamDavid: Arbitrary File Deletion via form field 'scjob' - CVE-2026-19011
TinyAGI agents.ts buildSystemPrompt file inclusion - CVE-2026-19009
TinyAGI Message API Endpoint response.ts collectFiles file i - CVE-2026-15307
Server-side file-write and request forgery via spatial looku
V. Comments for CVE-2026-19353
No comments yet