DeDeCMS CVE-2026-76800 concerns a new vulnerability in version 3 of the content management platform, which allows uncontrolled file uploads through a special point in the application. The vulnerability can be exploited remotely and the exploit has already been published.
entry for CVE-2026-76800 describes an issue in /include/dialog/select_media_post.php. The uploadfile is manipulated by a remote user, without sufficiently preventing the upload of a dangerous file type.
See also: CVE-2026-6847: unauthenticated RCE in ThemisNETPanel via file upload
What we know about DeDeCMS CVE-2026-76800
According to the official CVE listing, DeDeCMS 3 is affected, without specifying a specific version range. The description does not attribute the vulnerability to a specific function, but identifies the point where the application processes media files and related posts. With current evidence, DeDeCMS CVE-2026-76800 should be treated as an issue affecting specific installations, and not as evidence that every DeDeCMS website has been compromised.
The attack does not require user interaction and can be executed over a network. The assessment model reports low attack complexity and low required privileges, which means that the attacker needs some level of access, but not necessarily administrator privileges.
In practice, the risk depends on the configuration of each installation. An account with limited privileges can become a starting point for sending a file that bypasses type checks. If the file remains in an accessible directory or is executed by the server, the initial vulnerability can be compounded by other misconfigurations.
The listing attributes the issue to CWE-284 for inadequate access control and CWE-434 for uploading a dangerous file type. VulDB's CVSS 3.1 rating gives it a score of 6.3, in the moderate severity category, while the complementary CVSS 4.0 rating gives it a score of 2.1, low severity. Both descriptions record low impact on confidentiality, integrity, and availability.
The available information does not include indicators of compromise, specific operational exploits, or technical analysis confirming code execution. This limits safe conclusions about the actual impact, but does not negate the need to audit installations using the affected version and exposing the operation to the Internet.
The published exploit and limitations
Both the CVE Alert and CVE Record note that the exploit has been published and can be used. This is not in itself evidence of mass or active exploitation, but it does raise the need for immediate scrutiny of installations that expose the specific point to the Internet.
No fix or official workaround has been published in the available files. Therefore, administrators should not assume that simply changing the address of this point is sufficient. Permissions, allowed extensions, and server behavior should be checked after each upload request.
A low CVSS score does not eliminate the risk of an exposed website. The rating reflects the conditions and immediate impact of the specific scenario, not the value of a compromised server for lateral movement, malicious code installation, or content corruption. Therefore, the response must be based on the real-world environment.
See also: Joomla RSFiles: critical file upload vulnerability leads to RCE
Protection measures for DeDeCMS installations
Until there is a clear update from the maintainer, the SecNews technical team recommends restricting access to the admin interface and temporarily disabling the upload feature where possible. Web server rules should reject executable types and duplicate extensions, and files should be stored outside the site's root directory when the architecture allows.
Administrators should also review log files for requests to select_media_post.php, unusual values in the uploadfile , and new files in media directories. Looking for recent accounts, permission changes, and unknown files can indicate a prior exploit attempt.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Before making any changes, it is useful to take backups of the database and files, checking that they can indeed be restored. If a suspicious upload is detected, the server should be isolated from critical services, relevant logs should be maintained, and a check should be made for persistent access or changes to accounts.
Checks should be repeated after each update is applied. Disabling an access point without checking the files already stored leaves open the possibility that a breach has occurred. Monitoring outbound connections and changes to the site's root directory adds another layer of defense.
See also: ACSC: Massive CMS and plugin exploitation campaign leads to webshells
DeDeCMS CVE-2026-76800 is not yet accompanied by a known confirmed campaign, but the combination of a remote attack and a published exploit does not allow for complacency. The SecNews technical team recommends recording affected installations, limiting operation, and monitoring for an official fix.
