PT-2026-43092 · Redaxo · Mediapool Addon

Published 2026-05-23 · Updated 2026-05-23 · CVE-2018-25353

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Redaxo CMS Mediapool Addon versions prior to 5.5.2

Description An arbitrary file upload issue allows authenticated users with editor accounts to bypass file extension blacklist restrictions. By using obfuscated extensions such as php71 or php53, attackers can evade the blacklist filter to upload executable files and execute arbitrary code.

Recommendations Update to version 5.5.2 or newer.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2018-25353

Affected Products

Mediapool Addon

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-25353 · Security Note
• https://redaxo.org/download/redaxo/5.5.1.zip · Note
• https://t.me/CVEtracker/54730 · Telegram Post
• https://vulncheck.com/advisories/redaxo-cms-mediapool-addon-arbitrary-file-upload · Note
• https://redaxo.org · Note
• https://exploit-db.com/exploits/44891 · Note