How do I check whether I am affected by CVE-2021-48016?

Check whether the install is the 5.8.1 pre-release: include/common.func.php ShowMsg() has 'if ($gourl == -1) { $gourl = $_SERVER["HTTP_REFERER"] ...' and the value reaches DedeTemplate LoadString()/Display(). Look in data/tplcache for cached template files containing PHP, and in web logs for requests to /plus/flink.php?dopost=save with a PHP-looking Referer. Treat any hit as a compromise.

What is the fix for CVE-2021-48016?

No fixed version published in the sources I read (unknown). Move to a release build (5.7 SP2 line) or remove the 5.8.1-beta code. Stopgap: block or delete /plus/flink.php and other /plus/ endpoints, or filter requests with '<?' or '{dede:' in the Referer. Check the DedeCMS vendor site and GitHub for a patch.

Who is not affected by CVE-2021-48016?

Not affected if: dedecms-newer-than-5.8.1-beta, not-5.8.1-beta, not-dedecms, release-build.

Live › vulnerability › CVE-2021-48016

Go to dashboard

critical9.8Exploited in the wildOther

DedeCMS: crafted Referer header lets unauthenticated visitors run PHP code

Q: Who is not affected by CVE-2021-48016?

Not affected if: dedecms-newer-than-5.8.1-beta, not-5.8.1-beta, not-dedecms, release-build.

DedeCMS through 5.8.1-beta writes the HTTP Referer header into a template that is then included, so PHP code in the header is executed. An unauthenticated attacker can send a crafted request to /plus/flink.php with an empty validate code and run arbitrary PHP and system commands.

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Yes
Public exploit: 1 PoC repo on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, reported in the wild and proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Unauthenticated attacker runs system commands on the web server.
CVSS said: 9.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2021-48016

Go to dashboard

critical9.8Exploited in the wildOther

DedeCMS: crafted Referer header lets unauthenticated visitors run PHP code

Summary written from the sources below. Check the originals before acting.

CVSS 4.0

9.8

critical

scored by [email protected]

known so far6 of 6

First public: Oct 22, 2026 UTC
Last modified: Oct 23, 2026
Status: open
Known exploitation: Yes
Public exploit: 1 PoC repo on GitHub
EPSS: 0.4% in 30d

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is critical, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: Yes, reported in the wild and proof of concept public on GitHub.
Needs login: No.
Needs a special setup: Not known from the sources.
Reachable from: internet.
Worst case: Unauthenticated attacker runs system commands on the web server.
CVSS said: 9.8. The facts above agree.

Who is affected

1 product

Know the next one before it finds you.

Add to Slack

DedeCMS: crafted Referer header lets unauthenticated visitors run PHP code

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

DedeCMS: crafted Referer header lets unauthenticated visitors run PHP code

Why it is critical, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

Sources