CVE-2018-12045

Severity: critical (CVSS 9.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-06-08 · updated 2026-06-17
Weakness: CWE-434

Description

DedeCMS through V5.7SP2 allows arbitrary file upload in dede/file_manage_control.php via a dede/file_manage_view.php?fmdo=upload request with an upfile1 parameter, as demonstrated by uploading a .php file.

Affected products

DedeCMS: before 5.7; 5.7, 5.7-sp1, 5.7-sp2 — fixed in 5.7

How to fix

Upgrade to a fixed version: DedeCMS 5.7. Check the vendor advisory for mitigations.

References

https://github.com/SukaraLin/php_code_audit_project/blob/master/dedecms/dedecms%20v5.7%20sp2%20%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md
https://github.com/SukaraLin/php_code_audit_project/blob/master/dedecms/dedecms%20v5.7%20sp2%20%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1.md

Get alerted when CVE-2018-12045 or the next vulnerability affects your stack