CVE-2026-10581 is a server-side request forgery vulnerability affecting DedeCMS version 5.7.88. The vulnerability arises from improper handling of the 'Link' argument in the base64_decode function of the /plus/download.php?open=1 script, enabling attackers to coerce the server into making arbitrary HTTP requests. This flaw can be exploited remotely without user interaction and requires low privileges. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, and low impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability allows an attacker to make the affected server perform arbitrary HTTP requests, potentially accessing internal resources or services not directly accessible to the attacker. This can lead to information disclosure or further attacks leveraging internal network access. However, the impact on confidentiality, integrity, and availability is rated low to medium according to the CVSS vector. No known active exploitation has been reported.

No official patch or remediation is currently available for this vulnerability. Users of DedeCMS 5.7.88 should monitor vendor advisories for updates. In the meantime, restricting access to the vulnerable endpoint and implementing network-level controls to limit outbound requests from the server may reduce risk. Avoid exposing the affected functionality to untrusted users until a fix is released.