An attacker can upload a module to DedeCMS and manipulate the setup tag values to inject and execute arbitrary code. The flaw, classified as a code injection (CWE‑94), allows full control over the web application once the upload is processed, leading to compromise of confidentiality, integrity, and availability.

The issue impacts DedeCMS content‑management system version 5.7.118. Only installations running that exact version are confirmed vulnerable.

With a CVSS score of 9.8 the vulnerability is of critical severity. The EPSS score of less than 1% indicates that exploit activity is currently low and the flaw is not listed in the CISA KEV catalog. The likely attack vector is the web interface’s module upload feature, where insecure handling of setup tags permits code injection. No public exploit code is known, but the nature of the flaw would allow a malicious actor to execute arbitrary commands once a malicious upload is successfully processed.