Unauthenticated RCE in com_mb24sysapi and High-Severity CSRF in DedeCMS
Vulnerability Disclosure · 2 sources · Updated 4mo ago · First seen Mar 23, 2026
A newly recorded vulnerability, CVE-2026-32968, affects the com_mb24sysapi module and allows unauthenticated remote code execution through an OS command injection flaw. The weakness is classified as CWE-78 and stems from improper neutralization of special elements in OS commands, enabling a remote attacker to execute arbitrary commands and potentially take full control of an affected system. The CVE is described as a variant of CVE-2020-10383, carries a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, and is referenced by CERT VDE advisories VDE-2026-024 and VDE-2026-025.
A separate high-severity issue, CVE-2026-29839, was recorded for DedeCMS v5.7.118 in the /sys_task_add.php component. The flaw is a Cross-Site Request Forgery vulnerability classified as CWE-352, and its updated CVSS v3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that successful exploitation could significantly affect confidentiality, integrity, and availability. The record includes references to a public gist and the DedeCMS website, highlighting another internet-exposed web application weakness with potentially serious impact.
