The vulnerability allows attackers to forge authenticated requests to the sys_task_add.php endpoint. By exploiting it, an attacker can add or modify scheduled tasks within DedeCMS, potentially leading to privilege escalation or preferred actions executed under the authenticated user’s rights. This is identified as a Cross‑Site Request Forgery weakness (CWE‑352).

DedeCMS version 5.7.118 is affected. No other vendors or product versions have been reported. Users deploying this specific release should consider it compromised until a fix is applied.

The CVSS score of 8.8 reflects a high severity, while an EPSS score of less than 1% suggests a low probability of widespread exploitation in the near term. The vulnerability is not currently listed in CISA’s KEV catalog. Exploitation likely requires that a target user be authenticated and click a crafted URL or submit a forged request, making it a targeted attack vector. If successful, the attacker could perform privileged operations without being authenticated directly. Monitoring for abnormal task creation and applying a patch remain key defenses.