# CVE-2021-48016: DedeCMS PHP code injection in ShowMsg

Source: https://junglewise.ai/threats/cve-2021-48016-dedecms-through-5-8-1-beta-contains-a-php-code-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2021-48016 · Severity: critical · CVSS 9.8 · Published 2026-10-22

DedeCMS is a content management system widely used in China for building websites. A vulnerability in its ShowMsg() function allows attackers to inject arbitrary PHP code through the HTTP Referer header, bypassing authentication entirely. An attacker can remotely execute system commands and take full control of an affected website without any credentials.

Technologies: [DedeCMS](https://junglewise.ai/threats/technologies/dedecms). Vendors: [DedeCMS](https://junglewise.ai/threats/vendors/dedecms).

## Quick answers

**Is CVE-2021-48016 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-48016 being exploited in the wild.

**How severe is CVE-2021-48016?** Critical severity, with a CVSS score of 9.8, published 22 October 2026.

**Which products and versions are affected?** DedeCMS through 5.8.1-beta.

**Is there a fix for CVE-2021-48016?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2021-48016 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2021-48016?** Check whether you run DedeCMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The ShowMsg() function in DedeCMS through 5.8.1-beta unsafely incorporates the HTTP Referer header into a DedeTemplate string that is subsequently included and executed. An unauthenticated attacker can craft a malicious Referer header with PHP code and send it to /plus/flink.php?dopost=save with an empty validate code to achieve arbitrary code execution. The vulnerability is a combination of template injection and insufficient input validation.

## Affected products

- DedeCMS DedeCMS through 5.8.1-beta

## Timeline

- 2021-09-30: disclosed: Vulnerability published by srcincite
- 2023-10-14: exploited: Exploitation evidence observed by Shadowserver Foundation

## References

- [https://github.com/dedecms/DedeCMS/blob/v5.8.1/include/common.func.php](https://github.com/dedecms/DedeCMS/blob/v5.8.1/include/common.func.php)
- [https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/dedecms/dedecms-rce.yaml](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/dedecms/dedecms-rce.yaml)

## Related threats

- [DedeCMS local file inclusion in carbuyaction.php](https://junglewise.ai/threats/cve-2010-20125-dedecms-before-5-7-contains-a-file-inclusion-vulnerability-in)
- [DedeCMS advertisement rendering code injection in aid parameter](https://junglewise.ai/threats/cve-2026-116253-a-vulnerability-was-determined-in-dedecms-5-7-118-this)
- [DedeCMS reflected cross-site scripting in config.php](https://junglewise.ai/threats/cve-2014-125131-dedecms-5-6-and-5-7-contains-a-reflected-cross-site-scripting)
- [DedeCMS code injection in plus/mytag_js.php](https://junglewise.ai/threats/cve-2026-94004-a-vulnerability-was-found-in-dedecms-up-to-5-7-118-the-affected)
- [DeDeCMS unrestricted file upload in media dialog](https://junglewise.ai/threats/cve-2026-76800-dedecms-unrestricted-file-upload-in-media-dialog)