CVE-2026-10607: DedeCMS flink.php dede_htmlspecialchars sql injection
A vulnerability was identified in DedeCMS 5.7.88. The impacted element is the function dedehtmlspecialchars of the file /plus/flink.php. The manipulation of the argument msg leads to sql injection. The attack may be initiated remotely. The exploit is publicly available and might be used.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
DedeCMS /plus/flink.phpfrom your environment.Remove or rename the /plus/flink.php file (or uninstall/disable the flink feature/module) to eliminate the vulnerable dede_htmlspecialchars entry point if the functionality is not required.
- Configuration
Disable processing of the 'msg' parameter in /plus/flink.php or implement strict input validation/escaping for 'msg' to prevent SQL injection before restoring the file or functionality.
DedeCMS (dede_htmlspecialchars in /plus/flink.php) msg parameter handling = disabled or properly sanitized - Compensating control
Restrict external access to /plus/flink.php (for example via firewall, web server access controls, or WAF) to trusted IPs only, and/or deploy WAF rules to block SQL injection attempts targeting the 'msg' parameter.
- Operational
Search web server and database logs for requests to /plus/flink.php and suspicious 'msg' parameter activity, investigate for signs of compromise, and restore affected data from known-good backups if any compromise is detected.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10607?
The severity of CVE-2026-10607 is classified as medium with a score of 5.5.
How do I fix CVE-2026-10607?
To fix CVE-2026-10607, update DedeCMS to the latest version that addresses this SQL injection vulnerability.
What type of vulnerability is CVE-2026-10607?
CVE-2026-10607 is identified as an SQL injection vulnerability.
Can CVE-2026-10607 be exploited remotely?
Yes, CVE-2026-10607 can be exploited remotely by manipulating the argument msg.
Which function is affected by CVE-2026-10607?
The function affected by CVE-2026-10607 is dede_htmlspecialchars located in /plus/flink.php.