A critical (CVSS 9.8) PHP code injection flaw in DedeCMS through 5.8.1-beta lets unauthenticated attackers run arbitrary PHP and system commands, and the Shadowserver Foundation has observed exploitation evidence.
What Is It
CVE-2021-48016 is a PHP code injection vulnerability (CWE-94) in the ShowMsg() function of DedeCMS. The function writes the HTTP Referer header into a DedeTemplate string, which is then included and executed. An unauthenticated attacker can send a crafted Referer header to /plus/flink.php?dopost=save with an empty validate code and execute arbitrary PHP and system commands on the server.
VulnCheck assigned the CVE and NVD published it on 2026-10-22. Its NVD status is "Received". The record carries the unsupported-when-assigned tag.
Why It Matters
- Severity: CVSS 3.1 base score 9.8 (CRITICAL), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CVSS 4.0 score is 9.3 (CRITICAL). - Low barrier: The attack works over the network, has low complexity, and needs no privileges or user interaction.
- Full compromise: Confidentiality, integrity and availability impacts are all rated High.
- Exploitation evidence: According to the NVD description, the Shadowserver Foundation first observed exploitation evidence on 2023-10-14.
- Public tooling: A ProjectDiscovery nuclei template for this DedeCMS RCE is publicly listed in the references.
No CISA KEV entry was supplied for this CVE, so KEV confirmation of active exploitation and a federal remediation deadline are not available.
What's Vulnerable
- Vendor/Product: DedeCMS
- Affected versions: All versions from 0 through 5.8.1-beta, inclusive
- Vulnerable endpoint:
/plus/flink.php?dopost=save - Vulnerable code:
ShowMsg()ininclude/common.func.php
The NVD record lists no affected CPEs.
Patch Status
The supplied data names no fixed version, vendor patch or vendor advisory. The CVE carries the unsupported-when-assigned tag, which means the affected product was considered unsupported when the CVE was assigned. No CISA required action or due date is available because the KEV entry is empty. Organizations running DedeCMS 5.8.1-beta or earlier should check the VulnCheck advisory and the vendor repository for remediation guidance.