CVE-2010-20125: DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php

Q: Which deployments are exposed?

DedeCMS installations running a version earlier than 5.7 are affected. The vulnerable endpoint is plus/carbuyaction.php.

Q: Does exploitation require authentication or user interaction?

No. A remote attacker can exploit the issue without authentication or user interaction by manipulating the code parameter.

Q: What can an attacker do with this flaw?

An attacker can use ../../ path traversal sequences to control the path supplied to require_once and include local files outside the intended payment directory. The described impact is potential disclosure of arbitrary local files.

Q: What should be done if the instance cannot be upgraded immediately?

The provided data identifies DedeCMS 5.7 as the release boundary for the issue, but does not provide a documented workaround or mitigation for earlier versions.

Q: Is there evidence of exploitation?

Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Published Oct 30, 2026

Updated

DedeCMS before 5.7 contains a file inclusion vulnerability in plus/carbuyaction.php that allows remote unauthenticated attackers to control the include path by manipulating the uninitialized code parameter passed to requireonce. Attackers can supply path traversal sequences ../../ to include arbitrary local files outside the intended payment directory, potentially achieving local file disclosure. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

Event History

Oct 30, 2026

CVE Published

via MITRE·02:23 PM

Data Sourced

via MITRE·02:23 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·03:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

DedeCMS installations running a version earlier than 5.7 are affected. The vulnerable endpoint is plus/carbuyaction.php.

Does exploitation require authentication or user interaction?

No. A remote attacker can exploit the issue without authentication or user interaction by manipulating the code parameter.

What can an attacker do with this flaw?

An attacker can use ../../ path traversal sequences to control the path supplied to require_once and include local files outside the intended payment directory. The described impact is potential disclosure of arbitrary local files.

What should be done if the instance cannot be upgraded immediately?

The provided data identifies DedeCMS 5.7 as the release boundary for the issue, but does not provide a documented workaround or mitigation for earlier versions.

Is there evidence of exploitation?

Yes. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-18.

CVE-2010-20125: DedeCMS < 5.7 File Inclusion via plus/carbuyaction.php

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What can an attacker do with this flaw?

What should be done if the instance cannot be upgraded immediately?

Is there evidence of exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What can an attacker do with this flaw?

What should be done if the instance cannot be upgraded immediately?

Is there evidence of exploitation?