{"id":"CVE-2021-48016","kind":"vulnerability","aliases":["CVE-2021-48016"],"related":[],"title":"DedeCMS: crafted Referer header lets unauthenticated visitors run PHP code","description":"DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.","summary":"DedeCMS through 5.8.1-beta writes the HTTP Referer header into a template that is then included, so PHP code in the header is executed. An unauthenticated attacker can send a crafted request to /plus/flink.php with an empty validate code and run arbitrary PHP and system commands.","severity":"critical","cvss":9.8,"epss":0.00441,"exploited":true,"exploited_at":null,"products":[{"name":"DedeCMS","fixed":[],"affected":"5.8.1-beta (pre-release), per CVE through 5.8.1-beta","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cms","dedecms","other","package","php","rce","self-hosted"],"not_affected_if":["dedecms-newer-than-5.8.1-beta","not-5.8.1-beta","not-dedecms","release-build"],"how_to_check":"Check whether the install is the 5.8.1 pre-release: include/common.func.php ShowMsg() has 'if ($gourl == -1) { $gourl = $_SERVER[\"HTTP_REFERER\"] ...' and the value reaches DedeTemplate LoadString()/Display(). Look in data/tplcache for cached template files containing PHP, and in web logs for requests to /plus/flink.php?dopost=save with a PHP-looking Referer. Treat any hit as a compromise.","fix":"No fixed version published in the sources I read (unknown). Move to a release build (5.7 SP2 line) or remove the 5.8.1-beta code. Stopgap: block or delete /plus/flink.php and other /plus/ endpoints, or filter requests with '<?' or '{dede:' in the Referer. Check the DedeCMS vendor site and GitHub for a patch.","status":"open","published_at":"2026-10-22T11:17:04+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-23T22:32:31+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-10-23T22:32:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"DedeCMS: crafted Referer header lets unauthenticated visitors run PHP code","impact":"high","summary":"DedeCMS through 5.8.1-beta writes the HTTP Referer header into a template that is then included, so PHP code in the header is executed. An unauthenticated attacker can send a crafted request to /plus/flink.php with an empty validate code and run arbitrary PHP and system commands.","category":"other","who_cares":["dedecms","php","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Unauthenticated attacker runs system commands on the web server","analyst_note":"Exploited in the wild per Shadowserver (2023-10-14); the sources give no fixed release or check command, so confirm the patched version and a detection method for /plus/flink.php.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-dedecms","dedecms-newer-than-5.8.1-beta"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000499,"input_tokens":3045,"output_tokens":388,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Exploited in the wild per Shadowserver (2023-10-14); the sources give no fixed release or check command, so confirm the patched version and a detection method for /plus/flink.php.","search":"'-10':132C '-14':133C '-2021':12A,15A '-48016':13A,16A '/plus/flink.php':60B,106C '2023':131C '5.8.1':29B,75C 'arbitrari':68B,116C 'attack':53B,99C 'beta':30B,76C 'cms':18B 'code':10A,45B,65B,80C,113C 'command':72B,120C 'contain':77C 'craft':2A,57B,103C 'cve':11A,14A 'dedecm':1A,19B,27B,73C 'dedecms':17A 'dedetempl':94C 'dopost':107C 'empti':63B,111C 'evid':122C 'execut':50B,115C 'exploit':121C 'first':124C 'foundat':129C 'header':4A,35B,48B,89C 'host':26B 'http':33B,87C 'includ':42B,97C 'inject':81C 'let':5A 'observ':125C 'packag':21B 'php':9A,22B,44B,69B,79C,117C 'rce':23B 'refer':3A,34B,88C,104C 'request':58B 'run':8A,67B 'save':108C 'self':25B 'self-host':24B 'send':55B,101C 'shadowserv':128C 'showmsg':84C 'string':95C 'system':71B,119C 'templat':38B 'unauthent':6A,52B,98C 'valid':64B,112C 'visitor':7A 'vulner':82C 'write':31B 'written':91C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"A","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T11:17:04+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2021-48016","url":"https://nvd.nist.gov/vuln/detail/CVE-2021-48016","severity":null,"published_at":"2026-10-22T11:17:04+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2021-48016:212","url":null,"severity":null,"published_at":"2026-10-23T22:23:01+00:00","modified_at":"2026-10-23T22:23:01+00:00","first_seen_at":"2026-10-23T22:23:01+00:00","fetched_at":"2026-10-23T22:23:01+00:00","note":"CVE record says Shadowserver saw exploitation from 2023-10-14; Source Incite (original finder) says the bug was introduced 2020-12-11 in the 5.8.1 pre-release and never shipped in a release build. No vendor fix or advisory found. Public PoC write-ups exist. I did not read the Shadowserver report itself. Severity left at critical (CVSS 9.8, exploitation reported)."},{"source":"analyst","external_id":"CVE-2021-48016:245","url":null,"severity":null,"published_at":"2026-10-23T22:32:44+00:00","modified_at":"2026-10-23T22:32:44+00:00","first_seen_at":"2026-10-23T22:32:44+00:00","fetched_at":"2026-10-23T22:32:44+00:00","note":"Return visit: no new sources or documents. how_to_check and fix were empty again after the triage re-run, so I rewrote them from the Source Incite and CVE record pages. Fix is still unknown: no vendor patch found."},{"source":"epss","external_id":"CVE-2021-48016","url":"https://api.first.org/data/v1/epss?cve=CVE-2021-48016","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[{"id":1411,"url":"https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html","title":"Chasing a Dream :: Pre-authenticated RCE in Dedecms (Source Incite)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1412,"url":"https://github.com/Threekiii/Awesome-POC/blob/master/CMS%E6%BC%8F%E6%B4%9E/DedeCMS%205.8.1%20common.func.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md","title":"DedeCMS 5.8.1 common.func.php RCE (Awesome-POC)","kind":"poc","source":"analyst","text":null,"published_at":null,"relation":"poc","confidence":null,"note":null},{"id":1414,"url":"https://www.cve.org/CVERecord?id=CVE-2021-48016","title":"CVE Record: CVE-2021-48016","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}