PT-2026-26326 · Dedecms · Dedecms

Jacobjacob + 1 · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-30694

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DedeCMS versions prior to 5.7.119

Description A flaw exists in DedeCMS that allows a remote attacker to execute arbitrary code through the array filter component. The issue does not require authentication.

Recommendations Update to version 5.7.119 or later.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2026-30694

Affected Products

Dedecms

References · 6

• 🔥 https://jacobjacobjacob.gitbook.io/cve-2026-30694 · Exploit
• 🔥 https://leixyous-personal-organization.gitbook.io/dedecms-file-manage-getshell-via-bypass-blacklist · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-30694 · Security Note
• https://twitter.com/CVEnew/status/2036024253578158121 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2034731497698054443 · Twitter Post
• https://twitter.com/VolerionSec/status/2034696235127308418 · Twitter Post