---
id: "CVE-2021-48016"
kind: "vulnerability"
aliases: ["CVE-2021-48016"]
title: "DedeCMS: crafted Referer header lets unauthenticated visitors run PHP code"
severity: "critical"
cvss: 9.8
epss: 0.00441
exploited: true
status: "open"
category: "other"
products: [{"name": "DedeCMS", "fixed": [], "affected": "5.8.1-beta (pre-release), per CVE through 5.8.1-beta", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["cms", "dedecms", "other", "package", "php", "rce", "self-hosted"]
not_affected_if: ["dedecms-newer-than-5.8.1-beta", "not-5.8.1-beta", "not-dedecms", "release-build"]
published_at: "2026-10-22T11:17:04+00:00"
first_seen_at: "2026-10-23T21:57:30+00:00"
updated_at: "2026-10-24T07:15:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-48016", "first_seen_at": "2026-10-23T21:57:30+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:23:01+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T22:32:44+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-48016", "first_seen_at": "2026-10-24T07:15:51+00:00"}]
---

# DedeCMS: crafted Referer header lets unauthenticated visitors run PHP code

DedeCMS through 5.8.1-beta writes the HTTP Referer header into a template that is then included, so PHP code in the header is executed. An unauthenticated attacker can send a crafted request to /plus/flink.php with an empty validate code and run arbitrary PHP and system commands.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:DedeCMS affected 5.8.1-beta (pre-release), per CVE through 5.8.1-beta fixed ?

## How to check

Check whether the install is the 5.8.1 pre-release: include/common.func.php ShowMsg() has 'if ($gourl == -1) { $gourl = $_SERVER["HTTP_REFERER"] ...' and the value reaches DedeTemplate LoadString()/Display(). Look in data/tplcache for cached template files containing PHP, and in web logs for requests to /plus/flink.php?dopost=save with a PHP-looking Referer. Treat any hit as a compromise.

## Fix

No fixed version published in the sources I read (unknown). Move to a release build (5.7 SP2 line) or remove the 5.8.1-beta code. Stopgap: block or delete /plus/flink.php and other /plus/ endpoints, or filter requests with '<?' or '{dede:' in the Referer. Check the DedeCMS vendor site and GitHub for a patch.

## Timeline

- 2026-10-23T21:57:30+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-48016
- 2026-10-23T22:23:01+00:00 analyst — CVE record says Shadowserver saw exploitation from 2023-10-14; Source Incite (original finder) says the bug was introduced 2020-12-11 in the 5.8.1 pre-release and never shipped in a release build. No vendor fix or advisory found. Public PoC write-ups exist. I did not read the Shadowserver report itself. Severity left at critical (CVSS 9.8, exploitation reported).
- 2026-10-23T22:32:44+00:00 analyst — Return visit: no new sources or documents. how_to_check and fix were empty again after the triage re-run, so I rewrote them from the Source Incite and CVE record pages. Fix is still unknown: no vendor patch found.
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-48016

## Documents

- [advisory] Chasing a Dream :: Pre-authenticated RCE in Dedecms (Source Incite) https://srcincite.io/blog/2021/09/30/chasing-a-dream-pwning-the-biggest-cms-in-china.html
- [advisory] CVE Record: CVE-2021-48016 https://www.cve.org/CVERecord?id=CVE-2021-48016
- [poc] DedeCMS 5.8.1 common.func.php RCE (Awesome-POC) https://github.com/Threekiii/Awesome-POC/blob/master/CMS%E6%BC%8F%E6%B4%9E/DedeCMS%205.8.1%20common.func.php%20%E8%BF%9C%E7%A8%8B%E5%91%BD%E4%BB%A4%E6%89%A7%E8%A1%8C%E6%BC%8F%E6%B4%9E.md

## From the sources

DedeCMS through 5.8.1-beta contains a PHP code injection vulnerability in ShowMsg() where the HTTP Referer header is written into a DedeTemplate string and included. Unauthenticated attackers can send a crafted Referer to /plus/flink.php?dopost=save with an empty validate code to execute arbitrary PHP and system commands. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-14.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_