CVE-2026-15533: DedeCMS 5.7.118 RCE Vulnerability

CVE-2026-15533 Overview

CVE-2026-15533 is a code injection vulnerability affecting DedeCMS 5.7.118, a widely used Chinese-language content management system. The flaw resides in an unspecified function within /plus/search.php inside the Column Management component. An authenticated attacker can manipulate the Column Name argument to inject code that is written into a cache file and later executed by the application. The attack is remotely exploitable over the network, and public exploit material has been released. The issue is classified under [CWE-74] Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection).

Critical Impact
Attackers with valid backend privileges can write attacker-controlled PHP into a cache file through the Column Name field, enabling remote code execution on the DedeCMS host.

Affected Products

DedeCMS 5.7.118
Column Management component in /plus/search.php
Deployments exposing the DedeCMS administrative interface to remote users

Discovery Timeline

2026-07-13 - CVE-2026-15533 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15533

Vulnerability Analysis

The vulnerability affects the Column Management workflow in DedeCMS 5.7.118. When a user creates or edits a column, the supplied Column Name value flows into a cache file that DedeCMS writes to disk and later includes at runtime. Because the value is not properly neutralized before being embedded in cached PHP content, an attacker can inject arbitrary PHP into the cache file. When /plus/search.php or a related component references the tainted cache, the injected code executes in the context of the web server. Exploitation requires high privileges, meaning the attacker must already hold a backend account capable of managing columns. Public disclosure material references this behavior as a Column Name Cache File Writing RCE issue.

Root Cause

The root cause is missing input neutralization on the Column Name parameter before it is serialized into a PHP cache file. This matches [CWE-74], where user input crosses into a downstream interpreter without sanitization. DedeCMS treats the cached file as trusted PHP, so any injected syntax becomes executable code the next time the cache is loaded.

Attack Vector

The attack vector is network-based and requires authenticated access to the Column Management interface. An attacker submits a crafted Column Name value containing PHP tokens. DedeCMS writes the value into the associated cache file under the site's runtime data directory. Requests to /plus/search.php or other endpoints that include the cache then execute the injected payload, yielding remote code execution.

// No verified proof-of-concept code is published in the referenced advisories.
// Refer to the external references for technical write-ups.

Detection Methods for CVE-2026-15533

Indicators of Compromise

Unexpected modifications to DedeCMS cache files under the site's data/ directory, especially files associated with column metadata.
Requests to /plus/search.php immediately following administrative writes to Column Management endpoints.
Presence of PHP tags, eval, system, or assert strings inside cache files that should contain only serialized column data.

Detection Strategies

Monitor web server logs for POST requests to DedeCMS administrative column endpoints followed by GET requests to /plus/search.php from the same session.
Perform file integrity monitoring on the DedeCMS data/ cache directory and alert on any cache file containing PHP execution primitives.
Inspect application logs for backend accounts creating or renaming columns with non-standard characters such as <?php, backticks, or semicolons.

Monitoring Recommendations

Enable audit logging on DedeCMS administrator actions, focusing on Column Management create, edit, and delete operations.
Forward web and file system telemetry to a centralized analytics platform to correlate cache writes with subsequent PHP execution.
Alert on new outbound network connections initiated by the PHP-FPM or web server process shortly after a Column Management change.

How to Mitigate CVE-2026-15533

Immediate Actions Required

Restrict access to the DedeCMS backend using IP allowlists, VPN, or reverse proxy authentication until a fixed release is applied.
Audit all administrator and column-manager accounts and remove or rotate credentials for any account that is no longer required.
Review the DedeCMS data/ cache directory for suspicious PHP content and remove or regenerate affected cache files.

Patch Information

No vendor-supplied patch is referenced in the current advisories for CVE-2026-15533. Operators should track the VulDB entry for CVE-2026-15533 and the public write-up on GitHub for updates and upgrade to a fixed DedeCMS release when it becomes available.

Workarounds

Configure the web server to deny direct execution of PHP files inside DedeCMS cache directories under data/.
Enforce strict server-side validation on Column Name inputs to reject angle brackets, PHP tags, and other interpreter tokens.
Limit Column Management privileges to a minimal set of trusted administrators and require multi-factor authentication on those accounts.

bash

# Nginx example: prevent PHP execution inside DedeCMS cache directory
location ~ ^/data/.*\.php$ {
    deny all;
    return 403;
}