This vulnerability in DedeCMS's installation wizard allows remote file inclusion due to uncontrolled use of the _4_Setup function in install/index.php. The flaw arises from a user‑controlled input that is directly passed to an include operation, enabling an attacker to supply a path to an arbitrary file or remote URL. Successful exploitation would let a compromised attacker read or execute files on the web server, potentially revealing sensitive configuration data or executing arbitrary code, with the goal of compromising the application or gaining further access. The weakness corresponds to CWE‑73, which describes unsafe inclusion of external files.

The affected product is DedeCMS, versions up to and including 5.7.118 UTF8SP2. No specific vendor sub‑products are listed. The vulnerability resides in the installation component available to all users who have access to the installation wizard. If the system remains compromised, any end‑user with web access is at risk.

The CVSS score of 2.3 classifies this as low severity. Because no EPSS score is available, the current known exploitation probability is unknown, but the flaw has been publicly disclosed and could be used by an attacker with access to the installation wizard. The vulnerability is not listed in CISA KEV, yet public exploits have been reported. The attack vector is remote and requires the attacker to interact with the installation interface. Due to the absence of a proper mitigation in the component, this weakness could facilitate an attacker to include arbitrary content, which might lead to code execution or information disclosure on the server.