CVE-2017-17727
HighSummary
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the security of the system and user data.
Recommendation
It is recommended to update DedeCMS to the latest version and implement appropriate security mechanisms to prevent unauthorized file uploads.
Other vulnerabilities in DedeCMS
See all- CVE-2026-38615Critical
A command execution vulnerability in DedeCMS V5.7.118 in file_manage_control.php allows an attacker to execute arbitrary commands on the server.
- CVE-2023-34842Critical
Remote Code Execution vulnerability in DedeCMS through version 5.7.109 allows an attacker to execute arbitrary code via a crafted POST request to /dede/tpl.php.
- CVE-2023-37839Critical
DedeCMS v5.7.109 has an arbitrary file upload vulnerability in /dede/file_manage_control.php that allows attackers to execute arbitrary code by uploading a crafted PHP file.
- CVE-2017-17731Critical
DedeCMS through 5.7 is vulnerable to SQL Injection via the $_FILES superglobal in plus/recommend.php.
- CVE-2017-17730Critical
DedeCMS versions up to 5.7 are vulnerable to SQL Injection via the logo parameter in plus/flink_add.php.
- CVE-2026-76800Medium
A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/select_media_post.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used.
- CVE-2026-76783High
A security vulnerability has been detected in DeDeCMS 53_1_UTF8. This vulnerability affects unknown code of the file /plus/advancedsearch.php. Such manipulation of the argument sql leads to sql injection. The attack can be launched remotely. The exploit has been disclosed publicly and may be used.
- CVE-2026-19353Medium
A vulnerability was found in DedeCMS up to version 5.7.118 UTF8SP2, leading to file inclusion in the _4_Setup function of the file install/index.php in the Installation Wizard component. The attack can be executed remotely but is characterized by high complexity and difficult exploitability. The exploit has been publicly disclosed.
- CVE-2026-15700Medium
A path traversal vulnerability has been discovered in DedeCMS 5.7.118 in the ExtractFile function of include/zip.class.php, used in the Album Publishing Feature. Manipulation of the filename argument allows remote exploitation.
- CVE-2026-15533Medium
A security flaw was discovered in DedeCMS 5.7.118 in the file /plus/search.php within the Column Management component. Manipulating the Column Name argument allows remote code injection. The exploit has been publicly released and may be used in attacks.
Original NVD description (English source)
DedeCMS through 5.6 allows arbitrary file upload and PHP code execution by embedding the PHP code in a .jpg file, which is used in the templet parameter to member/article_edit.php.