Description

A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.3",
  "pubDate": "2026-08-20T03:16:23.887Z",
  "pubdate": "2026-08-20T03:16:23.887Z",
  "executiveSummary": "An arbitrary file upload vulnerability has been identified in DeDeCMS 3, specifically within the media upload handling functionality provided by the /include/dialog/select_media_post.php script. This security flaw stems from insufficient validation and sanitization mechanisms applied to user-supplied input via the uploadfile argument. Consequently, remote unauthenticated or authenticated attackers can leverage this defect to bypass security controls and upload arbitrary files, including malicious scripts such as web shells, directly to the underlying web server file system. The successful exploitation of this vulnerability poses severe risk implications, potentially resulting in remote code execution, complete system compromise, unauthorized data access, and full operational disruption of the affected web application. Because a public exploit has been developed and published, the likelihood of active exploitation in the wild is significantly elevated, demanding immediate defensive intervention and remediation procedures to secure vulnerable instances.",
  "technicalDetails": "The vulnerability resides in the backend processing logic implemented within the /include/dialog/select_media_post.php file of DeDeCMS 3. The root cause of the flaw is the absence of rigorous file type validation, extension whitelisting, and content-type verification on incoming file payloads processed through the uploadfile parameter. Specifically, the application fails to adequately restrict the types of files that can be uploaded to the server directory structure, allowing malicious actors to supply executable script files disguised as media or bypass intended file extension filters.\nThe attack flow proceeds as an HTTP-based remote exploitation vector where an attacker crafts a malicious HTTP POST request targeting the vulnerable /include/dialog/select_media_post.php endpoint. The attacker manipulates the uploadfile argument within the multipart/form-data payload to include a malicious file payload, such as a PHP-based web shell. Due to the lack of sufficient input sanitization and validation checks by the vulnerable component, the application accepts the file stream and stores it directly within a web-accessible directory on the server file system without neutralizing executable permissions or renaming the extension securely.\nOnce the file is successfully uploaded and written to the disk, the attacker can execute the payload by directly issuing an HTTP GET request to the path where the file was stored. This interaction triggers server-side code execution within the context of the web server process. Depending on the privileges assigned to the web service account, post-exploitation impact includes arbitrary command execution, pivoting to internal network segments, reading sensitive configuration files, modifying application databases, and deploying persistent backdoors. Network exposure is fully remote over standard HTTP or HTTPS protocols, and authentication requirements depend on the specific configuration of the administrative or media dialog interface exposed by the application."
}