DedeCMS version 5.7.118 contains a flaw in the file_manage_control.php script that allows an attacker to craft requests that result in arbitrary operating‑system command execution. This weakness is a classic example of command injection. The description does not specify authentication requirements, so it is inferred that an attacker would need to send crafted requests to any user able to reach the vulnerable endpoint. Such a compromise would grant the attacker the ability to execute any shell command with the permissions of the web server process.

The vulnerability affects the DedeCMS web content management system, specifically the 5.7.118 release. No other versions are listed as affected, so systems running earlier or later releases are presumed unaffected, but this should be verified against vendor advisories.

The CVSS score of 9.8 indicates a critical severity. The description indicates that command execution is possible via crafted requests to the vulnerable file_manage_control.php endpoint. It is not explicitly stated whether authentication is required; it is inferred that unrestricted access to the endpoint could allow exploitation. The risk remains high in environments where the application is publicly accessible, and the EPSS score of less than 1% suggests a low but non‑zero probability of exploitation. Attackers would likely use crafted HTTP requests to invoke filesystem commands, exploiting any insufficient input validation.