Executive brief
DedeCMS, a popular content management system, contains a security flaw in its file management module. An authorized user with access to the backend can bypass security filters to upload and execute malicious code on the server. This could allow an attacker to take full control of the website, steal sensitive data, or disrupt operations.
Technical details
A Remote Code Execution (RCE) vulnerability exists in DedeCMS <= V5.7.118 within the file_manage_control.php component. The vulnerability stems from an incomplete blacklist in the file content inspection logic, which fails to filter the 'get_defined_functions' PHP function. An authenticated attacker can use this function to dynamically invoke dangerous functions like 'system' or 'exec', bypassing regular expression checks. Furthermore, the application calls 'stripslashes()' on the 'str' parameter after initial security checks but before saving the file, effectively restoring any escaped malicious payloads. This allows an attacker to write arbitrary PHP code to the server and execute system-level commands.
Affected products
- DedeCMS DedeCMS <= V5.7.118
Timeline
- 2026-07-27: disclosed: Initial disclosure via Gitee and NVD publication