A flaw in DeDeCMS 3’s select_media_post.php allows an attacker to manipulate the uploadfile argument and upload arbitrary files without restriction. The CWE identifiers for this weakness are 284 (Improper Access Control) and 434 (Unrestricted Upload of File with Dangerous Type). Because the upload can be performed remotely, an attacker may place a script or dangerous file on the web server, possibly leading to remote code execution, data exfiltration, or escalation of privileges. The vulnerability was demonstrated publicly and is known to be exploitable.

All installations of DeDeCMS 3 are affected, specifically the include/dialog/select_media_post.php functionality. No other product versions or vendors are reported as impacted.

The CVSS score of 5.3 indicates a moderate severity, but the lack of an EPSS score and absence from the KEV catalog suggest exploitation is not yet widespread. Nevertheless, because the flaw is remotely exploitable and a proof‑of‑concept has been published, the risk of exploitation remains tangible. The attack vector is inferred to be web‑based, requiring the attacker to craft an HTTP request that supplies a malicious uploadfile parameter to the vulnerable endpoint.