---
id: CVE-2026-116063
title: DedeCMS update_guide.php require_once code injection
summary: >-
  A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the
  function require_once of the file dede/update_guide.php. This manipulation of
  the argument vtime causes code injection. Remote exploitation of the attack is
  possibl…
severity: medium
cvss: 4.7
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-94
  - CWE-74
product: DedeCMS
affected:
  - DedeCMS 5.7.118
published: '2026-10-25'
updated: '2026-10-25'
sourceUpdated: '2026-10-25T17:45:12.345Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-116063'
references:
  - url: 'https://vuldb.com/vuln/426146'
    label: VDB-426146 | DedeCMS update_guide.php require_once code injection
  - url: 'https://vuldb.com/vuln/426146/cti'
    label: 'VDB-426146 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-116063'
    label: CVE-2026-116063 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/999433'
    label: 'Submit #999433 | DedeCMS 5.7.118 Code Injection'
  - url: 'https://github.com/SDshadow/cve'
  - url: >-
      https://github.com/SDshadow/cve/tree/main/DedeCMS/V5.7.118-update_guide-RCE/poc
tags:
  - cve.org
ingestedAt: '2026-10-25T22:08:29.929Z'
---

## Overview

A weakness has been identified in DedeCMS up to 5.7.118. Impacted is the function require_once of the file dede/update_guide.php. This manipulation of the argument vtime causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

## Affected

- `DedeCMS 5.7.118`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.