CVE-2026-76800: DeDeCMS select_media_post.php unrestricted upload
A flaw has been found in DeDeCMS 3. Affected by this vulnerability is an unknown functionality of the file /include/dialog/selectmediapost.php. Executing a manipulation of the argument uploadfile can lead to unrestricted upload. The attack can be executed remotely. The exploit has been published and may be used.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker needs privileges, as reflected by the PR:L vector metric. No user interaction is required.
What access and impact does successful exploitation have?
The affected uploadfile argument can be manipulated to perform an unrestricted file upload through /include/dialog/select_media_post.php. The reported impact includes low confidentiality, integrity, and availability impact.
Is exploitation considered practical?
The vulnerability has low attack complexity, and a public exploit has been published. The reported exploit maturity is proof-of-concept.