CVE-2026-19353: DedeCMS File Inclusion Vulnerability

CVE-2026-19353 Overview

CVE-2026-19353 is a file inclusion vulnerability affecting DedeCMS versions up to 5.7.118 UTF8SP2. The flaw resides in the _4_Setup function within install/index.php, which is part of the Installation Wizard component. An attacker can manipulate input to this function to trigger file inclusion behavior remotely. The vulnerability is classified under [CWE-73] External Control of File Name or Path. Public disclosure has occurred, and exploitation details are available, though the exploit is described as having high complexity and difficult execution.

Critical Impact
Remote attackers with low privileges can influence file paths processed by the DedeCMS installer, potentially leading to unauthorized file inclusion during setup operations.

Affected Products

DedeCMS versions up to and including 5.7.118 UTF8SP2
Component: Installation Wizard (install/index.php)
Affected function: _4_Setup

Discovery Timeline

2026-08-09 - CVE-2026-19353 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-19353

Vulnerability Analysis

The vulnerability exists in the _4_Setup function of install/index.php in DedeCMS. This function handles a step in the Installation Wizard workflow. Attacker-controlled input reaches file path handling logic without sufficient validation. As a result, the application includes files based on manipulated parameters. The attack vector is network-based, and authentication with low privileges is required. Exploitation complexity is described as high, and the exploit is characterized as difficult to execute reliably in production environments. The impact scope includes limited confidentiality, integrity, and availability effects on the affected DedeCMS instance.

Root Cause

The root cause is improper control of file names used in include or require operations, tracked as [CWE-73]. The _4_Setup function does not adequately validate or sanitize path input before passing it to file inclusion routines. This allows an attacker to influence which file the installer loads during the setup stage.

Attack Vector

An authenticated attacker sends a crafted request to the DedeCMS installer endpoint at install/index.php targeting the _4_Setup step. The manipulated parameter influences which file the installer includes. Because the installation wizard may remain accessible on misconfigured or partially installed deployments, remote exploitation is possible over the network. Refer to the GitHub Issue Discussion and VulDB CVE Details for public technical details.

Detection Methods for CVE-2026-19353

Indicators of Compromise

HTTP requests to install/index.php after DedeCMS installation should have completed, particularly with step or setup-related parameters referencing _4_Setup.
Requests containing path traversal sequences (../) or absolute file paths in parameters submitted to the Installation Wizard.
Unexpected PHP file inclusions logged in web server or application logs originating from the installer script.

Detection Strategies

Monitor web server access logs for requests to /install/index.php on production DedeCMS deployments where the installer should no longer be reachable.
Deploy web application firewall rules that flag suspicious parameter values referencing filesystem paths sent to installer endpoints.
Baseline the presence and permissions of the install/ directory and alert when it is accessed after initial deployment.

Monitoring Recommendations

Enable PHP open_basedir restrictions and log violations triggered by unexpected file inclusion attempts.
Alert on new or modified files in the DedeCMS webroot that do not correspond to scheduled updates.
Track authentication events tied to the installer, as CVE-2026-19353 requires low-privilege access to be exploited.

How to Mitigate CVE-2026-19353

Immediate Actions Required

Remove or rename the install/ directory on production DedeCMS deployments once initial setup is complete.
Restrict network access to install/index.php at the web server or reverse proxy layer to trusted administrative IP addresses only.
Audit existing DedeCMS deployments for exposed installer endpoints and terminate any suspicious sessions.

Patch Information

At the time of NVD publication, no vendor-supplied patch is referenced in the CVE record. Administrators should consult the VulDB Vulnerability Overview and monitor the official DedeCMS project channels for a fixed release. Until a patch is available, apply the workarounds below to reduce exposure.

Workarounds

Delete the install/ directory or set its permissions to deny web access after initial DedeCMS deployment.
Configure the web server to return HTTP 403 for any request path matching /install/.
Enforce PHP configuration hardening such as open_basedir and disable allow_url_include to limit the impact of file inclusion flaws.
Restrict administrative accounts and rotate credentials to minimize the pool of low-privilege users who could reach the vulnerable function.

bash

# Example nginx configuration to block access to the DedeCMS installer
location ~ ^/install/ {
    deny all;
    return 403;
}

# PHP hardening in php.ini
allow_url_include = Off
open_basedir = "/var/www/dedecms/:/tmp/"