CVE-2026-94004: DedeCMS Remote Code Injection Vulnerability

CVE-2026-94004 Overview

CVE-2026-94004 is a code injection vulnerability affecting DedeCMS versions up to 5.7.118. The flaw resides in an unknown function within the plus/mytag_js.php file. Attackers can manipulate the aid parameter to inject arbitrary code into the application. The vulnerability is exploitable remotely without authentication or user interaction. A public exploit has been disclosed, increasing the likelihood of opportunistic attacks against exposed DedeCMS instances. The vulnerability is categorized under CWE-74, improper neutralization of special elements in output used by a downstream component.

Critical Impact
Remote, unauthenticated code injection through the aid parameter in plus/mytag_js.php with public exploit code available.

Affected Products

DedeCMS versions up to and including 5.7.118
Deployments exposing plus/mytag_js.php to untrusted networks
Web applications built on affected DedeCMS releases

Discovery Timeline

2026-09-20 - CVE-2026-94004 published to NVD
2026-09-21 - Last updated in NVD database

Technical Details for CVE-2026-94004

Vulnerability Analysis

The vulnerability lives in plus/mytag_js.php, a script that generates JavaScript output based on the aid request parameter. The application fails to properly neutralize user-controlled input before incorporating it into a downstream execution context. This allows attackers to inject code that the server subsequently processes. The issue falls under the CWE-74 category covering injection flaws where input contaminates control data.

Exploitation requires no authentication, no user interaction, and can be launched across the network. A working exploit has been published, lowering the barrier for attackers to weaponize the flaw against internet-exposed DedeCMS deployments. Refer to the VulDB entry for CVE-2026-94004 for additional technical context.

Root Cause

The root cause is missing input validation and output neutralization on the aid parameter processed by plus/mytag_js.php. User-supplied data reaches a code-handling routine without sanitization, enabling injection into an interpreter or execution path.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request to the plus/mytag_js.php endpoint with a malicious aid parameter value. The DedeCMS application processes the injected payload as code, leading to arbitrary behavior in the application context. No prior credentials or user interaction are required.

Code example not available. Consult the VulDB vulnerability record #407953 and the VulDB submission #944743 for public proof-of-concept details.

Detection Methods for CVE-2026-94004

Indicators of Compromise

HTTP requests to plus/mytag_js.php containing unusual characters, PHP syntax fragments, or encoded payloads in the aid parameter.
Unexpected file creation or modification within the DedeCMS webroot, particularly under plus/ and data/ directories.
Outbound connections from the web server to unknown hosts following requests to mytag_js.php.
Web server logs showing repeated aid parameter requests from a single source with varying payload structures.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the aid parameter for code-like content, function names, or PHP tags.
Correlate access log entries for plus/mytag_js.php with subsequent process spawning or file system changes on the web server.
Baseline normal traffic to plus/mytag_js.php and alert on anomalous parameter values or request rates.

Monitoring Recommendations

Enable verbose HTTP access logging on all DedeCMS front-end servers and forward to a centralized log platform.
Monitor PHP-FPM or web server worker processes for unexpected child processes such as shell interpreters.
Track integrity of files under the DedeCMS installation directory using file integrity monitoring tools.

How to Mitigate CVE-2026-94004

Immediate Actions Required

Restrict network access to plus/mytag_js.php via reverse proxy or firewall rules until a patched release is deployed.
Apply WAF signatures that block injection payloads targeting the aid parameter.
Audit web server and DedeCMS logs for prior exploitation attempts referencing mytag_js.php.
Review the DedeCMS installation for unauthorized files, modified templates, and unknown administrator accounts.

Patch Information

No vendor patch is referenced in the available advisory data at publication time. Monitor the DedeCMS project for updated releases beyond version 5.7.118 and consult the VulDB CVE-2026-94004 record for advisory updates.

Workarounds

Disable or remove the plus/mytag_js.php script if the functionality is not required by the deployment.
Enforce access control lists that limit requests to plus/ endpoints to trusted internal networks.
Implement request filtering that rejects aid parameter values containing non-alphanumeric characters where the application expects numeric identifiers.

bash

# Example nginx configuration to block external access to the vulnerable endpoint
location = /plus/mytag_js.php {
    deny all;
    return 403;
}