CVE-2026-30643 - An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload

CRITICAL

An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload

Published Apr 1, 2026

9.8

CRITICAL

CVSS 3.1

EPSS 0.78%

An issue was discovered in DedeCMS 5.7.118 allowing attackers to execute code via crafted setup tag values in a module upload.

No remediation recorded yet.

Weaknesses (1)

CWE-94

Code Injection

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-17960		Advisory
https://gist.github.com/0psPwn/10c43912adee9bfe2ff4fec947d4ee5a		ExploitThird Party Advisory
https://www.dedecms.com/		Product

No recorded changes yet.

Sources

Status PUBLISHED

Assigner mitre

Published Apr 1, 2026

Updated Apr 1, 2026

Reserved Mar 4, 2026

Updated Apr 1, 2026

Status Analyzed

Modified Jun 17, 2026

Severity n/a

Public date n/a

Assigner mitre

Published Apr 1, 2026

Updated Apr 1, 2026

Exploited since n/a