The vulnerability arises from a PHP code injection flaw in the ShowMsg() function, where the HTTP Referer header is inserted into a DedeTemplate string that is subsequently included. An attacker can craft a Referer header and send a request to /plus/flink.php?dopost=save with an empty validate code, allowing execution of arbitrary PHP and system commands without authentication. This flaw permits complete compromise of the affected system, including data exfiltration, modification, or destruction.

The issue affects the DedeCMS content management system with version 5.8.1-beta. Users running this specific release are directly exposed to the described exploitation. No other versions are listed as affected in the current data.

The CVSS score of 9.3 indicates critical severity. Although the EPSS score is not available, the recent observation of exploitation by the Shadowserver Foundation in October 2023 suggests a real risk of abuse. The vulnerability is not yet listed in CISA KEV, but the lack of an exploit probability metric means administrators should treat this as a high‑risk exposure. Attackers can likely exploit the flaw remotely via crafting a Referer header to the vulnerable endpoint without needing any prior authentication.