CVE-2026-29839: Dedecms v5.7.118 CSRF Vulnerability

CVE-2026-29839 Overview

DedeCMS v5.7.118 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /sys_task_add.php endpoint. This flaw allows attackers to trick authenticated administrators into performing unintended actions by crafting malicious web pages or links that submit forged requests to the vulnerable CMS. When an authenticated user visits a malicious page, the attacker can leverage their session to execute administrative functions without the user's knowledge or consent.

Critical Impact

Attackers can perform unauthorized administrative actions on DedeCMS installations by exploiting the lack of CSRF token validation in the task addition functionality, potentially leading to complete system compromise.

Affected Products

• DedeCMS v5.7.118
• DedeCMS Task Management Module (/sys_task_add.php)

Discovery Timeline

• 2026-03-24 - CVE-2026-29839 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-29839

Vulnerability Analysis

This Cross-Site Request Forgery vulnerability exists due to the absence of proper anti-CSRF token validation in the /sys_task_add.php file within DedeCMS v5.7.118. The vulnerability allows remote attackers to perform state-changing operations on behalf of authenticated administrators without proper authorization verification.

CSRF attacks exploit the trust that a web application has in the user's browser. When an administrator is logged into DedeCMS and visits a malicious website, the attacker's page can silently submit requests to the DedeCMS admin panel. Since the browser automatically includes session cookies with these requests, the CMS processes them as legitimate administrative actions.

The impact of successful exploitation includes the ability to create, modify, or delete system tasks, potentially leading to arbitrary code execution, data manipulation, or denial of service conditions depending on the functionality exposed through the task management system.

Root Cause

The root cause of this vulnerability is the failure to implement proper CSRF protection mechanisms in the /sys_task_add.php endpoint. The application does not generate, validate, or require anti-CSRF tokens for state-changing POST requests. This architectural weakness means the server cannot distinguish between legitimate requests initiated by the user and forged requests crafted by an attacker.

Additionally, the application likely relies solely on session cookies for authentication without implementing additional security measures such as SameSite cookie attributes, referrer validation, or origin header checking that could provide defense-in-depth against CSRF attacks.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must craft a malicious webpage containing hidden forms or JavaScript that automatically submits requests to the vulnerable DedeCMS endpoint. The attack flow typically involves:

1. The attacker creates a malicious webpage hosting an auto-submitting form targeting /sys_task_add.php
2. The attacker lures an authenticated DedeCMS administrator to visit the malicious page (via phishing email, malicious link, or compromised website)
3. The victim's browser automatically includes their DedeCMS session cookie with the forged request
4. The DedeCMS server processes the request as a legitimate administrative action
5. The attacker successfully creates or modifies system tasks without authorization

A proof-of-concept demonstrating this vulnerability is available at the GitHub Gist PoC repository. The exploit leverages the lack of CSRF token validation to forge administrative requests when an authenticated user visits a malicious page.

Detection Methods for CVE-2026-29839

Indicators of Compromise

• Unexpected system tasks appearing in the DedeCMS administration panel
• Access logs showing requests to /sys_task_add.php with external or suspicious referrer headers
• Administrative actions occurring without corresponding administrator login events
• Unusual task creation timestamps that don't correlate with normal administrative activity

Detection Strategies

• Monitor web server access logs for POST requests to /sys_task_add.php with referrer headers from external domains
• Implement web application firewall (WAF) rules to detect and block CSRF attack patterns
• Review DedeCMS audit logs for task creation or modification events during periods of low administrative activity
• Deploy browser security policies and Content Security Policy (CSP) headers to reduce CSRF attack surface

Monitoring Recommendations

• Enable comprehensive logging for all administrative endpoints in DedeCMS
• Configure SIEM alerts for requests to sensitive endpoints with mismatched origin/referrer headers
• Implement real-time monitoring of system task changes with alerting for unexpected modifications
• Conduct regular security audits of administrator activity logs to identify anomalous patterns

How to Mitigate CVE-2026-29839

Immediate Actions Required

• Restrict access to the DedeCMS administration panel to trusted IP addresses only
• Implement additional authentication requirements for critical administrative functions
• Deploy a web application firewall (WAF) with CSRF protection capabilities
• Educate administrators about phishing risks and the importance of not clicking suspicious links while logged into the CMS

Patch Information

As of the last NVD update on 2026-03-25, no official patch information has been released by the vendor. Administrators should monitor the DedeCMS official website for security updates and upgrade to patched versions when they become available.

Organizations running DedeCMS v5.7.118 should implement the workarounds below until an official patch is released.

Workarounds

• Implement IP-based access restrictions to limit administrative panel access to trusted networks only
• Add custom CSRF token validation by modifying the /sys_task_add.php file to require and validate anti-CSRF tokens
• Configure SameSite cookie attributes to Strict or Lax to prevent cookies from being sent with cross-origin requests
• Use browser extensions or security policies that block cross-origin form submissions to sensitive administrative endpoints

# Example: Restrict access to admin panel via .htaccess
<Files "sys_task_add.php">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Files>