CVE-2026-116063 in DedeCMS

Prediction

by VulDB Data Team • 10/24/2026

A weakness has been identified in <a href="/product/dedecms">DedeCMS up to 5.7.118</a>. Impacted is the function <code>require_once</code> of the file <em>dede/update_guide.php</em>. This manipulation of the argument <em>vtime</em> causes code injection. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

• Responsible: VulDB
• Moderation: accepted
• Entry: VDB-426146
• CPE: VulDB
• CWE: CWE-94 (confirmed)
• Exploit: Download
• CVSS: 4.7 (VulDB)
• EPSS: 0.00000
• KEV: no
• Activities: low
• Sector: Lawfirm, Agriculture, ...

Sources

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-116063
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-116063
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-116063/