CVE-2024-3686

CVE-2024-3686 is a path traversal vulnerability in DedeCMS 5.7.112-UTF8, specifically within the update_guide.php file when handling the 'files' argument. This allows an unauthenticated attacker to remotely manipulate file paths, potentially leading to unauthorized file creation or modification. Rated as HIGH severity with a CVSS score of 7.5, the vulnerability requires no user interaction and has low attack complexity, posing a significant integrity risk (I:H). While the vendor has not responded to disclosure, the exploit has been publicly disclosed. Currently, there is no evidence of active exploitation, and no known Metasploit, Nuclei, or ExploitDB modules exist. Community discussion and media coverage are minimal, indicating low public awareness despite the public exploit disclosure.