# CVE-2010-20125: DedeCMS local file inclusion in carbuyaction.php

Source: https://junglewise.ai/threats/cve-2010-20125-dedecms-before-5-7-contains-a-file-inclusion-vulnerability-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2010-20125 · Severity: high · CVSS 7.5 · Published 2026-10-30

DedeCMS is a content management system used to build websites. A flaw in the payment processing component allows unauthenticated attackers to read arbitrary files from the server by manipulating file path parameters. This could expose sensitive configuration files, database credentials, or other confidential data stored on the web server.

Technologies: [DedeCMS](https://junglewise.ai/threats/technologies/dedecms). Vendors: [DedeCMS](https://junglewise.ai/threats/vendors/dedecms).

## Quick answers

**Is CVE-2010-20125 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2010-20125 being exploited in the wild.

**How severe is CVE-2010-20125?** High severity, with a CVSS score of 7.5, published 30 October 2026.

**Which products and versions are affected?** DedeCMS before 5.7.

**Is there a fix for CVE-2010-20125?** Yes: fixed in DedeCMS 5.7. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2010-20125 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2010-20125?** Check whether you run DedeCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in DedeCMS 5.7

## Technical details

The vulnerability is a path traversal / local file inclusion flaw in plus/carbuyaction.php where an uninitialized or unsanitized parameter is passed to require_once(), allowing attackers to inject path sequences like ../../ to load files outside the intended directory. No authentication is required. Successful exploitation results in local file disclosure on the affected server.

## Affected products

- DedeCMS DedeCMS before 5.7

## Timeline

- 2026-10-30: disclosed
- 2023-10-18: exploited: Exploitation evidence first observed by Shadowserver Foundation

## References

- [https://github.com/dedecms/DedeCMS/blob/v5.6/plus/carbuyaction.php](https://github.com/dedecms/DedeCMS/blob/v5.6/plus/carbuyaction.php)
- [https://github.com/dedecms/DedeCMS/releases/tag/v5.7](https://github.com/dedecms/DedeCMS/releases/tag/v5.7)

## Related threats

- [DedeCMS advertisement rendering code injection in aid parameter](https://junglewise.ai/threats/cve-2026-116253-a-vulnerability-was-determined-in-dedecms-5-7-118-this)
- [DedeCMS PHP code injection in ShowMsg](https://junglewise.ai/threats/cve-2021-48016-dedecms-through-5-8-1-beta-contains-a-php-code-injection)
- [DedeCMS reflected cross-site scripting in config.php](https://junglewise.ai/threats/cve-2014-125131-dedecms-5-6-and-5-7-contains-a-reflected-cross-site-scripting)
- [DedeCMS code injection in plus/mytag_js.php](https://junglewise.ai/threats/cve-2026-94004-a-vulnerability-was-found-in-dedecms-up-to-5-7-118-the-affected)
- [DeDeCMS unrestricted file upload in media dialog](https://junglewise.ai/threats/cve-2026-76800-dedecms-unrestricted-file-upload-in-media-dialog)