PT-2026-66846 · Redaxo · Redaxo

CVE-2026-53599 · Published 2026-07-31 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions REDAXO versions 5.18.2 through 5.21.0

Description An authenticated backend user with media[upload] permissions can upload a JPEG/PHP polyglot file (a file that is valid as both a JPEG image and a PHP script) by using a filename with multiple extensions, such as shell.php.any.jpg. This is possible because the rex mediapool::isAllowedExtension() function in redaxo/src/addons/mediapool/lib/mediapool.php fails to correctly identify blocked extensions when they appear as non-terminal segments in a chain of three or more extensions.

On web servers configured with multi-extension PHP handlers (such as those using AddHandler or non-anchored FilesMatch regex), the uploaded file can be requested from the public media/ directory, allowing the attacker to execute arbitrary PHP code as the web-server user.

Recommendations Update REDAXO to version 5.21.1. As a temporary mitigation, restrict the use of the media[upload] permission to trusted users only or ensure the web server is configured to only execute PHP files that end strictly with a PHP extension.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-53599

GHSA-98PP-VCCM-QM25

Affected Products

Redaxo

References · 7

• 🔥 https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-53599 · Security Note
• https://osv.dev/vulnerability/GHSA-98pp-vccm-qm25 · Vendor Advisory
• https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340 · Note
• https://github.com/redaxo/core/releases/tag/5.21.1 · Note
• https://github.com/redaxo/core/pull/6538 · Note
• https://github.com/redaxo/core · Note