A vulnerability exists in DedeCMS, affecting versions up to 5.7.118, where the require_once call inside dede/update_guide.php can be manipulated by altering the vtime argument. This allows an attacker to inject code that is executed on the server, enabling full remote code execution. The weakness stems from improper handling of special characters (CWE‑74) and improper control of code generation (CWE‑94). Remote exploitation is possible because the vulnerable function is exposed via web requests.

The affected product is DedeCMS, versions up to and including 5.7.118. The issue impacts the function require_once in the update_guide.php module, regardless of specific deployment configurations, as the vulnerable code is present in all installations of the affected versions.

The CVSS score of 5.1 indicates a moderate severity, but the disclosure of public proof‑of‑concept code raises the threat level. The EPSS score is not available, making it difficult to gauge current exploitation density, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is remote HTTP requests that supply a crafted vtime parameter. If successfully exploited, an attacker can execute arbitrary code on the web server with the privileges of the underlying application.