CVE-2024-4790 is a medium severity path traversal flaw in DedeCMS 5.7.114, scored 4.3. A filename argument in an admin page can be pointed at files outside the intended folder. The vendor did not respond to the disclosure and no fixed version is listed, so limit access to the admin area and monitor for a patch.
What's affected
The record names DedeCMS 5.7.114. The flaw is in the file /sys_verifies.php with the action parameter set to view, and the weakness comes from the filename argument. The weaknesses are CWE-24, path traversal using the filedir pattern, and CWE-22, path traversal in general. The public write up in the record is titled as a directory traversal arbitrary file read.
The record says the attack can be started remotely, that the exploit has been disclosed to the public and that the vendor did not respond when contacted. It does not name a fixed version, and I could not confirm one in the sources, so check with the project directly.
On severity, NVD scores 4.3 Medium with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N, while VulDB's wording calls it problematic. These are consistent: a low impact on confidentiality, with low privileges needed. The KEV flag is false.
How to check if you're exposed
DedeCMS is a PHP content management system installed from a download, so a registry scan will not find it.
- Find DedeCMS sites in your hosting inventory. The admin folder usually carries the product name or a renamed path.
- Read the version from the admin footer or the version file.
- Confirm whether
sys_verifies.phpexists in the install. - Check web server logs for requests to that file with unusual filename values, such as repeated parent directory markers.
What to do now
- Restrict the admin area to trusted addresses with a web server rule or a VPN.
- Remove accounts that no longer need access, since the vector needs a login.
- Set the web server user to read only the files it needs, so that sensitive system files cannot be read.
- Keep secrets such as database passwords out of web readable configuration where possible, and rotate them if you suspect exposure.
- Watch the project and its community for a patched release.
- Consider a maintained alternative if the project stays silent.
Why it matters
Path traversal bugs happen when an application builds a file path from user input without confining it to a base folder. Parent directory sequences then let the request step out of the intended location. The safe pattern is to resolve the full path and check that it stays inside the allowed folder.
The score is low because a login is needed and only reading is possible. Still, readable configuration files often hold credentials that open the door to bigger problems. An unresponsive vendor makes the choice for you: harden around it, or move off it.
Quick check
Is a patch available?
The record lists none and says the vendor did not respond. Verify with the project before assuming one exists.
Sources
- Public write up referenced by the record (not read)
- VulDB entry 263889 (not readable without a browser session)
- NVD record data for CVE-2024-4790
Last reviewed: 19 October 2026.
