The vulnerability is a path traversal flaw in DedeCMS 5.7.118’s zip.class.php component, specifically within the ExtractFile function. By supplying a crafted filename, an attacker can read arbitrary files outside the intended directory, potentially exposing sensitive configuration files, credentials, or code. The weakness is identified as CWE‑22, indicating that the application fails to properly constrain file operations to an allowed directory, leading to unauthorized file disclosure. Based on the description, it is inferred that the attacker can trigger the path traversal remotely through a crafted HTTP request.

The flaw affects installations of DedeCMS version 5.7.118. Any site running this exact version and exposing the Album Publishing feature over HTTP is susceptible to exploitation, as the vulnerable code accepts user‑supplied filenames without proper validation. Based on the description, the attack requires the feature to be reachable over HTTP.

The CVSS score of 5.1 reflects medium severity. The EPSS score of less than 1% suggests the likelihood of exploitation is currently low. The vulnerability is not listed in CISA’s KEV catalog, yet public exploit code has been released. Attackers could remotely trigger the vulnerable function by sending a crafted HTTP request, enabling them to read arbitrary files and potentially gain further access. Based on the description, the likely attack vector is a remote web request to the vulnerable endpoint.