Zero Radar
← feed
CriticalVulnerabilityCVE-2021-48016updated 25 Oct 2026, 16:35 UTC

DedeCMS website software lets anyone run commands on the server

Attackers can send a specially crafted web request that makes the website run their own code and commands on the server, with no login needed. This can give them full control of the site.

Official, 2 sources
SeverityCriticalCVSS 9.3 of 10
Being exploited?UnclearNo reports either way yet
Fix available?UnclearNo fixed version published in the sources yet
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestCrafted Referer header, no login needed
  2. 2Site builds templateReferer text is written into template code
  3. 3Code gets executedServer runs the injected PHP
  4. 4Commands run on serverSystem commands run with server rights
  5. ResultAttacker controls the server

What happened

DedeCMS through 5.8.1-beta has a PHP code injection flaw in ShowMsg(), where the HTTP Referer header is written into a template string that is then included and executed. A crafted Referer sent to /plus/flink.php?dopost=save with an empty validate code triggers arbitrary PHP and system command execution.

Why it is dangerous: Unauthenticated attackers can execute arbitrary PHP and operating system commands, which can lead to full server takeover, data theft, defacement, or use of the server for further attacks.

Are you affected?

You are affected if you run DedeCMS up to and including version 5.8.1-beta with the flink.php page reachable from the internet.

DedeCMS through 5.8.1-beta

What to do

  1. Check whether your site runs DedeCMS version 5.8.1-beta or older.
  2. Block public access to /plus/flink.php or restrict it to trusted IP addresses until a fix is applied.
  3. Check the vendor or the GitHub advisory GHSA-8g3p-p68p-pg53 for a patched version and upgrade as soon as one is available.
  4. Review the server for unknown files, new accounts, or unexpected processes, since exploitation has been observed.

Timeline

  1. 22 Oct 2026, 11:17 UTC
    Publicly disclosed
  2. 22 Oct 2026, 11:17 UTC
    Reported by NVD · NVD
  3. 25 Oct 2026, 16:35 UTC
    GitHub Advisory reported on it · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2021-48016 · GHSA-8g3p-p68p-pg53
CVSS
9.3 / 10
EPSS
0.4% chance of exploitation within 30 days
Disclosed
22 Oct 2026, 11:17 UTC
On Zero Radar
before the radar started
Last change
25 Oct 2026, 16:35 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

DedeCMS website software lets anyone run commands on the server · Zero Radar