CVE-2026-53599: fallo de gravedad alta en redaxo core
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.5%
REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Productos afectados
redaxo · coreCVEs relacionadas — redaxo core
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-117532CRITICALREDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History PluginEPSS 0.7%CVE-2026-62998MEDIUMREDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationEPSS 0.4%CVE-2026-116893MEDIUMREDAXO core before 5.21.5 Missing Authorization in rex_api_package APIEPSS 0.3%CVE-2026-116896HIGHREDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication TablesEPSS 0.2%CVE-2026-116897HIGHREDAXO before 5.21.4 Missing Authorization in Version and History PreviewsEPSS 0.2%CVE-2026-117535MEDIUMREDAXO before 5.21.3 Reflected XSS via opener_link in Media PoolEPSS 0.2%