Quick answers
- Is CVE-2026-38615 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-38615 being exploited in the wild.
- How severe is CVE-2026-38615?
- Informational severity, with a CVSS score of 9.8, published 9 June 2026.
- Which products and versions are affected?
- DedeCMS V5.7.118.
- Is there a fix for CVE-2026-38615?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-38615 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-38615?
- Check whether you run DedeCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A command execution vulnerability exists in DedeCMS V5.7.118 within the file_manage_control.php script. The flaw likely stems from insufficient sanitization of user-supplied input passed to system-level functions or through insecure file handling logic. A remote attacker can exploit this vulnerability by sending a specially crafted request to the affected script, allowing for the execution of arbitrary OS commands. This typically results in full system compromise under the privileges of the web server user. While the advisory does not explicitly state authentication requirements, command execution in file management modules often bypasses or exploits administrative interfaces.
Affected products
- DedeCMS DedeCMS V5.7.118
Timeline
- 2026-06-09: disclosed: Initial disclosure and NVD publication