Description
A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64_decode of the file /plus/download.php?open=1. This manipulation of the argument Link causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | DedeCMS | 5.7.88 | — |
References
- VDB-367676 | DedeCMS download.php base64_decode server-side request forgery vdb-entry technical-description
- VDB-367676 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-10581 | CVE Analysis and Report third-party-advisory
- Submit #829404 | DedeCMS DedeCMS Content Management System v5.7.88 Server-Side Request Forgery (SSRF) / Open Redirect third-party-advisory