DeDeCMS version 3 contains an unrestricted file upload vulnerability in the /include/dialog/select_media_post.php component. This flaw allows remote attackers to manipulate the uploadfile parameter to upload files without restriction. The vulnerability requires low attack complexity and no user interaction but does require some privileges. Exploit code has been publicly disclosed, increasing the risk of exploitation. The CVSS 4.0 base score is 5.3, indicating medium severity.

Successful exploitation could allow an attacker to upload arbitrary files to the server, potentially leading to further compromise depending on the uploaded content and server configuration. The vulnerability can be triggered remotely and does not require user interaction, increasing its risk. However, the attack requires some privileges (PR:L) and the impact on confidentiality, integrity, and availability is limited (VC:L, VI:L, VA:L).

No official patch or remediation is currently documented. Users should monitor the vendor advisory for updates. Until a fix is available, restricting access to the vulnerable script and validating or restricting file uploads may reduce risk. Since no official fix is confirmed, patch status is not yet confirmed — check the vendor advisory for current remediation guidance.