PT-2025-48038 · Redaxo · Redaxo Cms

Published 2025-11-25 · Updated 2025-11-30 · CVE-2025-64050

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions REDAXO CMS version 5.20.0

Description A Remote Code Execution (RCE) issue exists in the template management component of REDAXO CMS. A remote, authenticated administrator can execute arbitrary operating system commands by injecting PHP code into an active template. When visitors access frontend pages using the compromised template, the injected code is executed. The payload is executed when visitors access frontend pages using the compromised template.

Recommendations Update to a newer version that contains a fix for this vulnerability.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2025-64050

GHSA-XJ9J-GJXG-7JVQ

Affected Products

Redaxo Cms

References · 7

• 🔥 https://github.com/vettrivel007/CVE-Disclosures/blob/main/CVE-2025-64050.md · Exploit
• 🔥 https://drive.google.com/drive/folders/1Via4r4wn5zCcBllWmHpxYweCPgcbN0bz?usp=sharing · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-64050 · Security Note
• https://osv.dev/vulnerability/CVE-2025-64050 · Vendor Advisory
• https://github.com/redaxo/redaxo · Note
• https://twitter.com/SecAideInfo/status/1994349856828395696 · Twitter Post
• https://twitter.com/cracbot/status/1995085461812060410 · Twitter Post