CVE-2023-37839

CriticalCVSS 9.8

Published: 13/07/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

1.04%

60th percentile - higher than 60% of all known CVEs

Summary

DedeCMS v5.7.109 has an arbitrary file upload vulnerability in /dede/file_manage_control.php that allows attackers to execute arbitrary code by uploading a crafted PHP file.

Risk Assessment

This vulnerability could lead to remote code execution, posing a serious threat to the security of the system and the organization's data.

Recommendation

It is recommended to update DedeCMS to the latest version and implement mechanisms to restrict file upload capabilities for users.

Original NVD description (English source)

An arbitrary file upload vulnerability in /dede/file_manage_control.php of DedeCMS v5.7.109 allows attackers to execute arbitrary code via uploading a crafted PHP file.