CVE-2025-5137 DedeCMS Incomplete Fix CVE-2018-9175 sys_verifies.php code injection
Remote attackers can execute arbitrary code via the refiles argument in sys_verifies.php due to an incomplete fix for a previous vulnerability.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5137?
CVE-2025-5137 is a medium-severity code injection vulnerability in Dedecms Dedecms, published on 25 May 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability was found in DedeCMS 5.7.117. It has been classified as critical. Affected is an unknown function of the file dede/sys_verifies.php?action=getfiles of the component Incomplete Fix CVE-2018-9175. The manipulation of the argument refiles leads to code injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.
Which versions are affected by CVE-2025-5137?
It affects 1 product.
Products include Dedecms Dedecms.
How do I fix CVE-2025-5137?
No fix has been published for CVE-2025-5137 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-5137 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5137 exists.
Other vulnerabilities in Dedecms Dedecms
Sources
Also known as GHSA-27jg-5m5x-f2g4.