CVE-2026-76800: DeDeCMS 3 RCE Vulnerability

CVE-2026-76800 Overview

CVE-2026-76800 is an unrestricted file upload vulnerability in DeDeCMS 3. The flaw resides in the /include/dialog/select_media_post.php script, where the uploadfile argument is processed without adequate restrictions on file type or content. An authenticated attacker with low privileges can manipulate this argument remotely to upload arbitrary files to the server. The weakness is categorized under [CWE-284: Improper Access Control]. A public exploit has been disclosed, increasing the likelihood of opportunistic scanning against exposed DeDeCMS instances.

Critical Impact
Remote authenticated attackers can upload arbitrary files to vulnerable DeDeCMS 3 installations, potentially enabling webshell deployment and follow-on compromise of the hosting environment.

Affected Products

DeDeCMS 3
Deployments exposing /include/dialog/select_media_post.php
Web applications relying on the vulnerable media upload handler

Discovery Timeline

2026-08-20 - CVE-2026-76800 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-76800

Vulnerability Analysis

The vulnerability affects the media upload dialog exposed by DeDeCMS 3 at /include/dialog/select_media_post.php. The endpoint accepts the uploadfile parameter and processes uploaded content without enforcing sufficient constraints on extension, MIME type, or destination path. Because access control on the endpoint is improper [CWE-284], a low-privileged authenticated user can invoke the handler and place arbitrary files under a web-accessible directory.

When an attacker uploads a script file that the underlying PHP interpreter will execute, the upload primitive escalates to remote code execution in the context of the web server process. From that foothold, attackers commonly stage webshells, pivot to database credentials stored in DeDeCMS configuration files, and establish persistence on the host.

Root Cause

The root cause is improper access control combined with missing validation of uploaded file attributes in select_media_post.php. The handler trusts client-supplied metadata for the uploadfile argument rather than enforcing a strict allow list of file types and safe storage locations outside the executable web root.

Attack Vector

Exploitation is network-based and requires low privileges but no user interaction. An attacker authenticates to DeDeCMS, submits a crafted multipart request to /include/dialog/select_media_post.php with a malicious uploadfile payload, and then requests the uploaded resource to trigger execution. Public exploit details are referenced through VulDB CVE-2026-76800 and the Feishu Wiki Resource.

No verified proof-of-concept code is reproduced here. See the VulDB Vulnerability #393317 entry for technical exploitation details.

Detection Methods for CVE-2026-76800

Indicators of Compromise

Unexpected POST requests to /include/dialog/select_media_post.php containing the uploadfile parameter from low-privileged accounts.
New .php, .phtml, or double-extension files appearing under DeDeCMS media or upload directories.
Outbound connections initiated by the web server process shortly after successful upload requests.

Detection Strategies

Inspect web server access logs for authenticated sessions issuing POST requests to select_media_post.php followed by GET requests to newly created files.
Deploy web application firewall rules to flag multipart uploads referencing script extensions targeting the DeDeCMS media dialog.
Correlate file system creation events in upload directories with process execution events from the PHP interpreter.

Monitoring Recommendations

Enable file integrity monitoring on DeDeCMS upload paths and template directories.
Alert on any child process spawned by the web server user, such as sh, bash, or cmd.exe.
Retain multipart request bodies at the reverse proxy layer to support post-incident forensic review.

How to Mitigate CVE-2026-76800

Immediate Actions Required

Restrict network access to the DeDeCMS administrative interface, including /include/dialog/ endpoints, to trusted IP ranges.
Audit existing DeDeCMS user accounts and revoke unused low-privileged accounts that could be leveraged for exploitation.
Scan the media and upload directories for unauthorized script files and remove any suspicious artifacts.

Patch Information

No vendor advisory or official patch has been referenced in the NVD entry for CVE-2026-76800 at the time of publication. Monitor the VulDB CVE-2026-76800 record and the DeDeCMS project channels for a fixed release, and apply it as soon as it becomes available.

Workarounds

Configure the web server to deny script execution within DeDeCMS upload directories using per-directory execution policies.
Enforce a strict server-side allow list of permitted file extensions and validate MIME types before persisting uploaded files.
Place a web application firewall rule in blocking mode for requests to /include/dialog/select_media_post.php originating from untrusted networks.

bash

# Example nginx configuration to disable PHP execution in DeDeCMS upload paths
location ~ ^/(uploads|include/dialog)/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}