CVE-2026-15700: DedeCMS Path Traversal Vulnerability

CVE-2026-15700 Overview

CVE-2026-15700 is a path traversal vulnerability [CWE-22] in DedeCMS 5.7.118. The flaw resides in the ExtractFile function of include/zip.class.php within the Album Publishing Feature. An attacker can manipulate the filename argument to traverse directories outside the intended extraction path. The issue is exploitable remotely, though it requires high privileges to trigger. A public proof of concept has been released, raising the practical risk of opportunistic exploitation against exposed DedeCMS installations.

Critical Impact
Authenticated attackers can write or extract files to arbitrary locations on the server by supplying crafted archive entries, potentially leading to file overwrite or code placement on the web server.

Affected Products

DedeCMS 5.7.118
Component: include/zip.class.php (ExtractFile function)
Feature: Album Publishing Feature

Discovery Timeline

2026-07-14 - CVE-2026-15700 published to the National Vulnerability Database (NVD)
2026-07-15 - Last updated in NVD database
2026-07-20 - EPSS score recorded at 0.363% (percentile 28.693)

Technical Details for CVE-2026-15700

Vulnerability Analysis

The vulnerability exists in the archive extraction logic used by DedeCMS to process uploaded album files. When ExtractFile in include/zip.class.php processes archive entries, it uses the attacker-controlled filename field from the archive header without normalizing directory components. As a result, archive entries containing sequences such as ../ are honored when writing files to disk. The attack requires authenticated access to the Album Publishing Feature but no user interaction. Because DedeCMS ships as a content management system exposed to the internet, this issue provides a foothold for attackers who obtain administrative or publisher credentials.

Root Cause

The root cause is missing canonicalization and validation of file paths extracted from ZIP archive entries. ExtractFile concatenates the destination directory with the raw filename field from the archive rather than resolving and constraining the final path to the intended extraction root. This is a classic Zip Slip pattern classified under [CWE-22] Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

An authenticated user with access to the Album Publishing Feature uploads a specially crafted ZIP archive. The archive contains one or more entries whose names include relative path traversal sequences targeting locations outside the album directory. When DedeCMS extracts the archive, the crafted entries are written to attacker-chosen paths, such as web-accessible directories. The vulnerability is reachable over the network, and a public proof of concept is available in the GitHub PoC Repository.

No verified exploit code is reproduced here. Refer to the VulDB CVE-2026-15700 entry for additional technical context.

Detection Methods for CVE-2026-15700

Indicators of Compromise

Files appearing outside the album upload directory, particularly PHP files in web-accessible paths not created by legitimate administrators.
ZIP archives uploaded through the Album Publishing Feature that contain entries with ../ sequences in their filenames.
Unexpected modifications to DedeCMS core files, configuration files, or .htaccess files following an album upload event.

Detection Strategies

Inspect web server access logs for POST requests to album publishing endpoints followed by requests to newly created files in unusual paths.
Scan uploaded archives at the perimeter or web application firewall for entries containing path traversal sequences before they reach DedeCMS.
Perform file integrity monitoring across the DedeCMS web root to detect files placed outside expected directories.

Monitoring Recommendations

Enable audit logging for administrative and publisher accounts that can access the Album Publishing Feature.
Alert on the creation of executable content, such as .php, .phtml, or .htaccess files, in directories that should only contain static media.
Correlate authentication events with subsequent file write activity to identify abuse of legitimate accounts.

How to Mitigate CVE-2026-15700

Immediate Actions Required

Restrict access to the DedeCMS administrative interface using network controls, IP allowlisting, or VPN gating.
Audit accounts with publishing privileges and remove or disable unused administrator and editor accounts.
Review the DedeCMS web root for unexpected files and roll back any unauthorized changes.

Patch Information

At the time of publication, no vendor patch is referenced in the NVD entry. Monitor the VulDB Vulnerability #378247 record and official DedeCMS release channels for security updates addressing the ExtractFile function in include/zip.class.php.

Workarounds

Disable the Album Publishing Feature if it is not required for business operations.
Deploy web application firewall rules that block ZIP uploads containing entries with ../ or absolute path components.
Enforce filesystem permissions so the DedeCMS process cannot write outside its intended content directories.
Rotate credentials for all privileged DedeCMS accounts if exposure is suspected.

bash

# Example: filesystem permission hardening for the DedeCMS web root
chown -R www-data:www-data /var/www/dedecms
find /var/www/dedecms -type d -exec chmod 755 {} \;
find /var/www/dedecms -type f -exec chmod 644 {} \;
# Restrict write access to the album upload directory only
chmod 750 /var/www/dedecms/uploads/allimg