CVE-2023-7212 is an unrestricted file upload flaw in the backend of DedeCMS up to version 5.7.112. It scores 4.7 (Medium) because it needs a high privilege account. The vendor did not respond, and no fixed version is named, so lock down the admin area.
What's affected
Affected: DedeCMS up to and including 5.7.112. The vulnerable code is in file_class.php in the Backend component.
Fixed: none named. The description says the vendor was contacted early and did not respond. The record notes the exploit was disclosed publicly. KEV is false.
Severity note: the description calls it critical (a VulDB label), while NVD scores it 4.7, Medium, because the vector requires high privileges (PR:H) and the impacts are low. The title follows the score. The weakness is CWE-434, unrestricted upload of a file with a dangerous type.
How to check if you're exposed
Find your DedeCMS version in the admin dashboard or in the install files. Anything at 5.7.112 or lower is in range.
find . -name file_class.php
Then check who holds backend accounts and whether the admin path is reachable from the internet. Review the upload directories for files with executable extensions that you did not put there.
What to do now
- Check the DedeCMS project for a release newer than 5.7.112 and apply it if one exists.
- Restrict the backend path to a VPN or an IP allow list.
- Make sure the upload directories cannot execute scripts, for example by disabling PHP execution there at the web server.
- Audit backend accounts, remove unused ones, and enforce unique passwords.
- Scan the web root for files you do not recognise.
Why it matters
Unrestricted upload bugs let a user place a file the system should have refused. If an uploaded file is a script and the server will run it, the upload turns into code execution. Defenses are an allow list of file types, checking contents and not just names, storing uploads outside the web root, and disabling execution in upload folders.
The privilege requirement lowers the urgency, but admin accounts get phished and reused. A bug that is hard to reach today can be easy to chain tomorrow.
For teams running a CMS, a practical habit helps: keep a short list of every CMS install, its version, who holds admin rights, and whether the backend is public. When a CVE like this one appears with no patch, that list tells you in minutes whether you are affected and which mitigation to apply first.
Quick check
Does CVE-2023-7212 need a login?
Yes. The vector requires high privileges, which is why it scores 4.7.
Is a fix available?
Not named in the record. Check the DedeCMS site for newer versions.
Sources
Last reviewed: 19 October 2026.
