CVE-2026-51078: Dede CMS Information Disclosure Flaw

CVE-2026-51078 Overview

CVE-2026-51078 is an information disclosure vulnerability in Dede CMS v5.7.118. The flaw resides in the file_manage_control.php component and can be triggered through the str parameter. A remote, unauthenticated attacker can send a crafted request over the network to retrieve sensitive information from the affected system. The issue is categorized under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Dede CMS is a widely deployed Chinese content management system, so exposure of file management endpoints raises the risk of secondary attacks against site administrators. A public proof-of-concept is referenced in the CVE record.

Critical Impact
Unauthenticated remote attackers can read sensitive information exposed by file_manage_control.php in Dede CMS v5.7.118.

Affected Products

Dede CMS v5.7.118
file_manage_control.php component
Deployments exposing the CMS administrative endpoints over the network

Discovery Timeline

2026-07-27 - CVE-2026-51078 published to NVD
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-51078

Vulnerability Analysis

The vulnerability affects the file_manage_control.php component of Dede CMS v5.7.118. The endpoint processes the str parameter without adequate access control or output filtering. As a result, remote attackers can craft HTTP requests that cause the component to return sensitive information back to the client. The flaw is network-exploitable, requires no authentication, and requires no user interaction. Confidentiality is the sole impact dimension; integrity and availability are not affected according to the CVSS vector. Public proof-of-concept material is hosted on Gitee, which lowers the practical barrier to exploitation. See the Gitee PoC for CVE-2026-51078 and the DedeCMS Official Website for product context.

Root Cause

The root cause is improper access control and information exposure in the file_manage_control.php script [CWE-200]. The str parameter is consumed by file management logic that returns file or directory contents to callers who should not have visibility into them. The component fails to enforce an authenticated session or restrict the scope of data returned when the parameter is manipulated.

Attack Vector

An attacker sends an HTTP request to the Dede CMS instance targeting file_manage_control.php with a crafted str parameter. The server responds with sensitive file or path information. No credentials, tokens, or prior access to the CMS are required. Because the endpoint is typically exposed on the same web port as the public site, any reachable installation is a candidate target. Refer to the referenced PoC for exact request structure.

No verified exploit code is reproduced here. The public proof-of-concept can be reviewed at the Gitee reference above for technical request details.

Detection Methods for CVE-2026-51078

Indicators of Compromise

HTTP requests to /file_manage_control.php containing a str query parameter from external or unexpected sources.
Web server access logs showing 200 responses to file_manage_control.php without a preceding authenticated administrator session.
Anomalous outbound response sizes from file_manage_control.php correlated with unauthenticated clients.

Detection Strategies

Inspect web server and application logs for accesses to file_manage_control.php where the Referer or session cookies are missing or inconsistent with administrative use.
Deploy web application firewall (WAF) rules that flag requests to file_manage_control.php carrying a str parameter from non-administrative source IPs.
Correlate suspect requests with follow-on activity such as credential reuse attempts, admin login probes, or file upload attempts.

Monitoring Recommendations

Forward Dede CMS access logs to a centralized logging platform and alert on requests to sensitive administrative scripts.
Baseline normal administrator source IPs and generate alerts when file_manage_control.php is reached from unrecognized networks.
Track EPSS movement for CVE-2026-51078 and reprioritize response if exploitation likelihood increases.

How to Mitigate CVE-2026-51078

Immediate Actions Required

Restrict network access to the Dede CMS administrative interface, including file_manage_control.php, to trusted management networks or VPN users.
Review web logs for prior requests to file_manage_control.php containing a str parameter and treat matches as potential information leakage.
Rotate credentials and secrets that may have been exposed through file management responses.

Patch Information

No vendor advisory URL is listed in the CVE record at publication. Administrators should monitor the DedeCMS Official Website for a security update addressing file_manage_control.php in v5.7.118 and apply it as soon as it becomes available.

Workarounds

Block external HTTP access to file_manage_control.php at the reverse proxy or WAF layer until a patch is applied.
Require authentication and IP allow-listing on all administrative PHP endpoints of Dede CMS.
Remove or rename unused file management scripts from the deployed webroot where operationally feasible.

bash

# Nginx example: restrict file_manage_control.php to an admin subnet
location = /file_manage_control.php {
    allow 10.10.0.0/24;   # trusted admin network
    deny  all;
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php/php-fpm.sock;
}