Is CVE-2021-48016 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-48016 being exploited in the wild.

How severe is CVE-2021-48016?

Critical severity, with a CVSS score of 9.8, published 22 October 2026.

Is there a fix for CVE-2021-48016?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2021-48016 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2021-48016?

Check whether you run DedeCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-48016: DedeCMS PHP code injection in ShowMsg

CVE-2021-48016 · Severity: critical · CVSS 9.8 · Published 2026-10-22

DedeCMS is a content management system widely used in China for building websites. A vulnerability in its ShowMsg() function allows attackers to inject arbitrary PHP code through the HTTP Referer header, bypassing authentication entirely. An attacker can remotely execute system commands and take full control of an affected website without any credentials.

Technologies: DedeCMS. Vendors: DedeCMS.

Quick answers

Is CVE-2021-48016 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-48016 being exploited in the wild.
How severe is CVE-2021-48016?: Critical severity, with a CVSS score of 9.8, published 22 October 2026.
Which products and versions are affected?: DedeCMS through 5.8.1-beta.
Is there a fix for CVE-2021-48016?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2021-48016 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2021-48016?: Check whether you run DedeCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The ShowMsg() function in DedeCMS through 5.8.1-beta unsafely incorporates the HTTP Referer header into a DedeTemplate string that is subsequently included and executed. An unauthenticated attacker can craft a malicious Referer header with PHP code and send it to /plus/flink.php?dopost=save with an empty validate code to achieve arbitrary code execution. The vulnerability is a combination of template injection and insufficient input validation.

Affected products

DedeCMS DedeCMS through 5.8.1-beta

Timeline

2021-09-30: disclosed: Vulnerability published by srcincite
2023-10-14: exploited: Exploitation evidence observed by Shadowserver Foundation

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.