PT-2026-45690 · Dedecms · Dedecms

R21Z20 · Published 2026-06-02 · Updated 2026-06-02 · CVE-2026-10581

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions DedeCMS version 5.7.88

Description A flaw in the base64 decode() function within the '/plus/download.php?open=1' endpoint allows for server-side request forgery (SSRF), a condition where a server is tricked into making unauthorized requests to internal or external resources. This occurs through the manipulation of the Link argument, enabling remote exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict access to the '/plus/download.php?open=1' endpoint or avoid using the Link parameter until a patch is available.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-10581

Affected Products

Dedecms

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-10581 · Security Note
• https://vuldb.com/submit/829404 · Note
• https://vuldb.com/cve/CVE-2026-10581 · Note
• https://vuldb.com/vuln/367676/cti · Note
• https://vuldb.com/vuln/367676 · Note
• https://twitter.com/VulmonFeeds/status/2061693037076517340 · Twitter Post