# CVE-2026-51078: DedeCMS remote code execution in file_manage_control.php

Source: https://junglewise.ai/threats/cve-2026-51078-dedecms-remote-code-execution-in-file-manage-control-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-27. Updated: 2026-07-27  
License: CC BY 4.0 with a link back

CVE-2026-51078 · Severity: info · CVSS 8.8 · Published 2026-07-27

DedeCMS, a popular content management system, contains a security flaw in its file management module. An authorized user with access to the backend can bypass security filters to upload and execute malicious code on the server. This could allow an attacker to take full control of the website, steal sensitive data, or disrupt operations.

Technologies: [DedeCMS](https://junglewise.ai/threats/technologies/dedecms). Vendors: [DedeCMS](https://junglewise.ai/threats/vendors/dedecms).

## Quick answers

**Is CVE-2026-51078 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-51078 being exploited in the wild.

**How severe is CVE-2026-51078?** Informational severity, with a CVSS score of 8.8, published 27 July 2026.

**Which products and versions are affected?** DedeCMS <= V5.7.118.

**Is there a fix for CVE-2026-51078?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-51078 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-51078?** Check whether you run DedeCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Remote Code Execution (RCE) vulnerability exists in DedeCMS <= V5.7.118 within the file_manage_control.php component. The vulnerability stems from an incomplete blacklist in the file content inspection logic, which fails to filter the 'get_defined_functions' PHP function. An authenticated attacker can use this function to dynamically invoke dangerous functions like 'system' or 'exec', bypassing regular expression checks. Furthermore, the application calls 'stripslashes()' on the 'str' parameter after initial security checks but before saving the file, effectively restoring any escaped malicious payloads. This allows an attacker to write arbitrary PHP code to the server and execute system-level commands.

## Affected products

- DedeCMS DedeCMS <= V5.7.118

## Timeline

- 2026-07-27: disclosed: Initial disclosure via Gitee and NVD publication

## References

- [https://gitee.com/etera1i2e/cve-2026-51078/blob/master/README.md](https://gitee.com/etera1i2e/cve-2026-51078/blob/master/README.md)
- [https://www.dedecms.com/](https://www.dedecms.com/)

## Related threats

- [DedeCMS local file inclusion in carbuyaction.php](https://junglewise.ai/threats/cve-2010-20125-dedecms-before-5-7-contains-a-file-inclusion-vulnerability-in)
- [DedeCMS advertisement rendering code injection in aid parameter](https://junglewise.ai/threats/cve-2026-116253-a-vulnerability-was-determined-in-dedecms-5-7-118-this)
- [DedeCMS PHP code injection in ShowMsg](https://junglewise.ai/threats/cve-2021-48016-dedecms-through-5-8-1-beta-contains-a-php-code-injection)
- [DedeCMS reflected cross-site scripting in config.php](https://junglewise.ai/threats/cve-2014-125131-dedecms-5-6-and-5-7-contains-a-reflected-cross-site-scripting)
- [DedeCMS code injection in plus/mytag_js.php](https://junglewise.ai/threats/cve-2026-94004-a-vulnerability-was-found-in-dedecms-up-to-5-7-118-the-affected)