CVE-2023-2928: DedeCMS article_allowurl_edit.php code injection via allurls

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCVSS 8.8 with remote, low-privilege code injection and a public exploit disclosure make this a high-priority fix despite the absence of KEV listing.

What it is

DedeCMS up to 5.7.106 contains a code injection flaw in uploads/dede/article_allowurl_edit.php, where manipulation of the allurls argument allows injected code to be executed. The vulnerability is rated critical by the source and carries a CVSS 3.1 base score of 8.8, so it warrants prompt attention on any exposed DedeCMS deployment.

Impact

An authenticated attacker can inject and execute code through the allurls parameter, gaining high impact to confidentiality, integrity and availability of the affected installation. This can lead to full compromise of the CMS and its underlying host depending on deployment context.

Attack surface

The flaw is reachable remotely over the network through the article_allowurl_edit.php endpoint in the DedeCMS admin area. The CVSS vector indicates low privileges are required (PR:L) and no user interaction (UI:N), so a valid low-privileged account is sufficient.

Exploitation

No CISA KEV listing is present, but EPSS is high at roughly 0.51 (98.9th percentile) and the description states a public exploit has been disclosed and may be used. Reference tags are only Third Party Advisory and Broken Link, so no vendor-confirmed exploit maturity is available.

What to do

• Apply the latest DedeCMS update or vendor fix for the affected file; if no patch exists, treat the component as unsupported and plan migration.
• Restrict access to the DedeCMS admin directory (uploads/dede/) to trusted management networks or VPN only.
• Enforce least privilege on DedeCMS accounts and remove or disable unused low-privileged users.
• Deploy a WAF rule blocking suspicious allurls parameter values targeting article_allowurl_edit.php.
• Monitor and alert on unexpected file writes or code execution originating from the DedeCMS web process.

Detection

• Review web server logs for POST requests to uploads/dede/article_allowurl_edit.php with unusual or encoded allurls parameters.
• Hunt for newly created or modified PHP files under the DedeCMS web root outside normal deployment windows.
• Alert on outbound connections or process spawning from the web server user that is inconsistent with normal CMS behavior.
• Correlate admin-area access from unexpected source IPs or accounts with subsequent file system changes.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.