CVE-2026-10581: DedeCMS download.php base64_decode server-side request forgery

Published Jun 2, 2026

Updated

A flaw has been found in DedeCMS 5.7.88. Affected by this vulnerability is the function base64decode of the file /plus/download.php?open=1. This manipulation of the argument Link causes server-side request forgery. Remote exploitation of the attack is possible. The exploit has been published and may be used.

Affected Software

1 affected component

DedeCMS Dedecms=5.7.88

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Remove
Remove DedeCMS /plus/download.php from your environment.
Remove or disable the /plus/download.php script (or the open=1 functionality) until a vendor-supplied patch is available to eliminate the SSRF vulnerability in DedeCMS 5.7.88.
Configuration
Disable or harden processing of the open=1 Link parameter in /plus/download.php: stop calling base64_decode on untrusted input, add strict validation to ensure the decoded value is not a URL or network address, or reject requests where Link decodes to an external/internal URL.
DedeCMS /plus/download.php processing of open=1 Link parameter (base64_decode) = disable or validate
Compensating control
Apply network-level controls to prevent SSRF exploitation: block or restrict outbound HTTP(S) requests from the web server to internal and external hosts, and restrict access to /plus/download.php (open=1) to trusted IPs via firewall, WAF, or reverse proxy rules.
Operational
Search web server and application logs for attempts to call /plus/download.php?open=1 and for unusual outbound connections; if exploitation is suspected, contain and investigate affected hosts and rotate any credentials or secrets that could have been accessed via SSRF.

Event History

Jun 2, 2026

CVE Published

via MITRE·02:30 AM

Data Sourced

via MITRE·02:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-10581?

The severity of CVE-2026-10581 is classified as low with a score of 2.1.

How do I fix CVE-2026-10581?

To fix CVE-2026-10581, upgrade DedeCMS to a version that has addressed this vulnerability.

What type of attack is associated with CVE-2026-10581?

CVE-2026-10581 is associated with a server-side request forgery (SSRF) attack.

Which software is affected by CVE-2026-10581?

DedeCMS version 5.7.88 is affected by CVE-2026-10581.

Can CVE-2026-10581 be exploited remotely?

Yes, CVE-2026-10581 allows for remote exploitation of the vulnerability.