CVE-2025-6335: DedeCMS RCE Vulnerability

CVE-2025-6335 Overview

CVE-2025-6335 is a command injection vulnerability in DedeCMS versions up to 5.7.2. The flaw resides in the /include/dedetag.class.php file within the Template Handler component. Attackers can manipulate the notes argument to inject commands processed by the template engine. The vulnerability is exploitable over the network but requires high privileges to trigger. Public disclosure of the exploit technique has occurred, increasing exposure for unpatched installations. The issue is categorized under [CWE-74] (Improper Neutralization of Special Elements in Output Used by a Downstream Component).

Critical Impact

Authenticated remote attackers can inject commands through the DedeCMS template handler, affecting confidentiality, integrity, and availability of the content management system.

Affected Products

• DedeCMS versions up to and including 5.7.2
• Component: Template Handler (/include/dedetag.class.php)
• Vendor: DedeCMS

Discovery Timeline

• 2025-06-20 - CVE-2025-6335 published to NVD
• 2026-04-29 - Last updated in NVD database

Technical Details for CVE-2025-6335

Vulnerability Analysis

The vulnerability exists in the DedeCMS template processing logic implemented in dedetag.class.php. The Template Handler component accepts user-controlled input through the notes argument without sufficient neutralization. This allows an authenticated attacker to inject commands that the template engine subsequently processes. According to EPSS data, the vulnerability has a probability score of 1.016% and sits in the 77.5 percentile for exploitation likelihood.

Root Cause

The root cause is improper neutralization of special elements [CWE-74] in the notes parameter handled by the Template Handler. The dedetag.class.php file fails to sanitize or validate input before passing it to a downstream interpreter. This permits content that should be treated as data to be parsed as executable directives.

Attack Vector

The attack is network-accessible and requires high privileges, meaning the attacker must already hold an authenticated administrative or elevated role within the DedeCMS instance. No user interaction is required once the attacker has the necessary credentials. After authentication, the attacker submits crafted input through the notes argument to the vulnerable template handler endpoint. The injected payload is then executed by the template engine in the context of the web application.

No verified proof-of-concept code is publicly available in structured form.
Refer to the GitHub issue report and VulDB entries for technical artifacts:
 - https://github.com/jujubooom/CVE/issues/1
 - https://vuldb.com/?id.313331

Detection Methods for CVE-2025-6335

Indicators of Compromise

• Unexpected modifications to template files or cached template artifacts within the DedeCMS installation directory.
• HTTP POST requests submitting unusual content to the notes parameter handled by dedetag.class.php.
• Web server processes spawning unexpected child processes such as shells or system utilities.
• Outbound network connections originating from the web server to unfamiliar destinations following template edits.

Detection Strategies

• Inspect web server access logs for requests targeting template management endpoints with abnormally long or encoded notes values.
• Monitor file integrity on /include/dedetag.class.php and template cache directories for unauthorized writes.
• Correlate administrative authentication events with subsequent template modification activity to identify credential abuse.

Monitoring Recommendations

• Enable verbose logging on PHP execution and capture command execution functions such as eval, system, and exec.
• Track administrator session activity and alert on template handler interactions from new IP addresses or user agents.
• Deploy a web application firewall rule set to flag suspicious payloads sent to DedeCMS administrative routes.

How to Mitigate CVE-2025-6335

Immediate Actions Required

• Restrict administrative access to the DedeCMS backend using network ACLs or VPN gating to reduce the authenticated attack surface.
• Audit existing administrator accounts and rotate credentials, removing any unused or stale privileged users.
• Review template management logs for evidence of notes parameter abuse since the install date.

Patch Information

No official vendor patch URL is listed in the CVE record. Administrators should consult the GitHub CVE Issue Report and VulDB entry #313331 for the latest remediation guidance, and monitor official DedeCMS channels for an updated release beyond 5.7.2.

Workarounds

• Disable or restrict access to the template editing functionality if it is not required for daily operations.
• Apply web application firewall rules that block command metacharacters in the notes parameter for dedetag.class.php requests.
• Run the DedeCMS PHP process under a least-privileged operating system account to limit the impact of successful injection.

# Example nginx location block restricting admin access by IP
location ~* /dede/ {
    allow 10.0.0.0/8;
    deny all;
    try_files $uri $uri/ /index.php?$args;
}