DedeCMS CVE-2026-10581

Q: What is the CVSS score of CVE-2026-10581?

CVE-2026-10581 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-33878 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-02 VulDB

GHSA-7vqp-qmqp-chh2

PHP SSRF

2.1

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Jun 02, 2026 - 04:22 NVD

MEDIUM LOW

CVSS changed

Jun 02, 2026 - 04:22 NVD

6.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Jun 02, 2026 - 04:15 vuln.today

DescriptionCVE.org

A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64_decode of the file /plus/download.php?open=1. This manipulation of the argument Link causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used.

AnalysisAI

Server-side request forgery in DedeCMS 5.7.88 allows low-privileged authenticated remote attackers to make the server issue arbitrary HTTP requests by manipulating the base64-decoded Link argument in /plus/download.php?open=1. Exploitation enables internal network probing, potential access to cloud metadata endpoints (e.g., AWS IMDSv1), and limited confidentiality, integrity, and availability impact (C:L/I:L/A:L per CVSS). Publicly available exploit code exists (CVSS temporal E:P; description confirms exploit publication), though no confirmed active exploitation or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

DedeCMS (Dedecms) is a widely deployed PHP-based content management system popular in Chinese-language web environments. The vulnerability resides in /plus/download.php, a file handling download functionality when the query parameter open=1 is set. The PHP built-in function base64_decode() is applied to the attacker-supplied Link parameter, and the decoded value is subsequently used to initiate a server-side HTTP request without adequate input validation or allowlisting. This is a classic CWE-918 (Server-Side Request Forgery) pattern: user-controlled data is decoded and passed directly to an HTTP client, enabling the web server to be weaponized as a proxy. The CPE string cpe:2.3:a:n/a:dedecms:*:*:*:*:*:*:*:* uses wildcards across all versions, suggesting the vendor has not been formally registered in NVD's CPE dictionary and the exact affected version range beyond 5.7.88 has not been bounded by NVD.

RemediationAI

No vendor-released patch has been identified at time of analysis - all references trace back to VulDB, and no official DedeCMS security advisory was found in the provided data. As a primary compensating control, restrict access to /plus/download.php entirely via web server configuration (e.g., Nginx location deny or Apache mod_rewrite) if the download-with-open feature is not required; this eliminates the attack surface with no functional side effect for most sites. If the endpoint must remain active, implement server-side URL validation that enforces an allowlist of permitted domains or IP ranges before passing the decoded Link value to any HTTP client function - block all RFC-1918, loopback (127.0.0.1), and link-local addresses to prevent internal network probing. Additionally, disable or restrict cloud metadata endpoint access (e.g., block 169.254.169.254 at the host firewall level) to prevent credential theft via SSRF in cloud-hosted deployments. Monitor VulDB (https://vuldb.com/vuln/367676) and the DedeCMS project repository for an upstream patch release before applying permanent fixes.