CVE-2026-10581: DedeCMS 5.7.88 SSRF Vulnerability

CVE-2026-10581 Overview

CVE-2026-10581 is a server-side request forgery (SSRF) vulnerability in DedeCMS 5.7.88. The flaw resides in the base64_decode handling within /plus/download.php?open=1, where the Link parameter is decoded and used to issue server-initiated requests. Remote attackers with low-privilege authentication can manipulate the Link argument to coerce the application into sending requests to attacker-controlled or internal destinations. The exploit has been published, increasing the likelihood of opportunistic abuse against exposed DedeCMS deployments. The weakness is tracked under [CWE-918].

Critical Impact
Authenticated remote attackers can pivot the DedeCMS server to reach internal services, exfiltrate metadata, or probe non-routable network segments via crafted Link values.

Affected Products

DedeCMS 5.7.88
/plus/download.php endpoint with open=1 parameter
Deployments exposing the Link argument to untrusted users

Discovery Timeline

2026-06-02 - CVE-2026-10581 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-10581

Vulnerability Analysis

The vulnerability exists in the download handler at /plus/download.php. When the open=1 flag is set, the script accepts a Link parameter, base64-decodes it, and uses the resulting value as a target URL for a server-side fetch. Insufficient validation of the decoded URL allows attackers to specify arbitrary schemes, hosts, and ports. The DedeCMS server then issues outbound requests on behalf of the attacker, satisfying the conditions for SSRF [CWE-918]. The EPSS probability is 0.029% with a percentile of 8.71, reflecting low observed exploitation activity at the time of disclosure, though public exploit code raises that risk profile.

Root Cause

The root cause is missing allow-list validation on the user-supplied Link value after base64 decoding. The application trusts the decoded string as a download target without restricting it to expected hosts, protocols, or IP ranges. Internal addresses such as 127.0.0.1, link-local ranges, and cloud metadata endpoints are reachable from the request context.

Attack Vector

An authenticated remote attacker sends a GET request to /plus/download.php?open=1 with a Link parameter containing a base64-encoded URL pointing to an internal or attacker-chosen resource. The server decodes the value and performs an outbound HTTP request to the supplied destination. Responses or timing differences can leak data about internal services. No code execution is implied, but the SSRF can be chained to access unauthenticated internal APIs, cloud instance metadata, or perform port scanning of the internal network.

No verified exploit code is available in the data set. Refer to the VulDB entry for CVE-2026-10581 and VulDB Vulnerability #367676 for technical write-ups.

Detection Methods for CVE-2026-10581

Indicators of Compromise

Web server access logs containing requests to /plus/download.php?open=1 with a populated Link parameter.
Outbound connections from the DedeCMS host to internal RFC1918 addresses or cloud metadata endpoints such as 169.254.169.254.
Base64-encoded payloads in URL query strings that decode to URLs targeting localhost or internal services.

Detection Strategies

Inspect web access logs for download.php requests with open=1 and decode any Link values to identify suspicious targets.
Correlate PHP process network connections with HTTP request logs to flag unexpected egress destinations.
Apply web application firewall rules that decode and validate base64 parameters reaching DedeCMS endpoints.

Monitoring Recommendations

Alert on outbound traffic from web tier hosts to internal management interfaces or metadata services.
Track authentication events preceding download.php access to identify low-privilege accounts abusing the endpoint.
Baseline expected outbound destinations from DedeCMS servers and alert on deviations.

How to Mitigate CVE-2026-10581

Immediate Actions Required

Restrict access to /plus/download.php at the reverse proxy or WAF until a vendor fix is applied.
Block the DedeCMS server from initiating outbound connections to RFC1918 networks and cloud metadata IPs.
Audit existing logs for prior exploitation attempts against the affected endpoint.

Patch Information

No vendor patch is referenced in the available data. Monitor the DedeCMS project and VulDB Submission #829404 for updated remediation guidance.

Workarounds

Disable the open=1 code path in download.php if the download proxy functionality is not required.
Enforce an allow-list of permitted hostnames inside download.php before issuing any server-side fetch.
Require strict URL parsing that rejects non-HTTP(S) schemes, internal IP literals, and DNS names resolving to private ranges.

bash

# Example nginx rule to block the vulnerable endpoint pattern
location ~* /plus/download\.php {
    if ($arg_open = "1") { return 403; }
}