CVE-2015-4553: DeDeCMS unrestricted file upload allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 8.8 and a high EPSS percentile with public exploit code make this a serious remote code execution risk, though it is not in CISA KEV.

What it is

DeDeCMS before 5.7-sp1 contains an unrestricted file upload flaw (CWE-434) that lets a malicious user upload a file and gain shell access. The vulnerability is remotely reachable and requires only low privileges, making it a direct path to server compromise.

Impact

An attacker can upload a crafted file to execute arbitrary code on the server, leading to full compromise of the web application and its host. This can result in data theft, defacement, or use of the server as a foothold for further attacks.

Attack surface

The flaw is reachable over the network (AV:N) with low privileges required (PR:L) and no user interaction (UI:N). An attacker with a valid low-privileged account can upload a malicious file through the affected upload functionality.

Exploitation

Public exploit code is available (Exploit-DB 37423 and a Full Disclosure post), and EPSS indicates a high probability of exploitation in the wild (0.56738, 99th percentile). The CVE is not listed in CISA KEV, so no confirmed active exploitation is recorded there.

What to do

• Upgrade DeDeCMS to version 5.7-sp1 or later immediately.
• Restrict upload directories to prevent execution of uploaded files (e.g., disable script execution via web server configuration).
• Validate and whitelist allowed file types and extensions on the server side for all uploads.
• Apply the principle of least privilege to the web server process and any accounts that can upload files.
• Monitor and audit file upload activity for suspicious files or unexpected script execution.

Detection

• Monitor web server logs for POST requests to upload endpoints followed by access to newly uploaded files with executable extensions.
• Alert on creation of files with script extensions (e.g., .php, .phtml, .jsp) in upload or data directories.
• Use file integrity monitoring to detect unexpected new executable files in web-accessible paths.
• Review application logs for uploads by low-privileged users that result in files outside expected content types.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.