CVE-2021-48016 DedeCMS 5.8.1-beta Unauthenticated RCE via plus/flink.php
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2021-48016?
CVE-2021-48016 is a critical vulnerability in DedeCMS, published on 22 Oct 2026.
Official description
DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.
Weakness: CWE-94
Which versions are affected by CVE-2021-48016?
How do I fix CVE-2021-48016?
No fix has been published for CVE-2021-48016 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-48016 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-48016 exists.
Sources
Also known as GHSA-8g3p-p68p-pg53.