CVE-2026-53599: CVE-2026-53599: Authenticated Remote Code Execution in REDAXO CMS via Mediapool File Upload Validation Bypass

#security #cve #cybersecurity

CVE-2026-53599: Authenticated Remote Code Execution in REDAXO CMS via Mediapool File Upload Validation Bypass

Vulnerability ID: CVE-2026-53599
CVSS Score: 7.5
Published: 2026-07-31

An authenticated file upload validation bypass vulnerability exists in the REDAXO CMS Mediapool addon in versions 5.18.2 through 5.21.0. Under permissive web server configurations, this allows authenticated users with media upload privileges to achieve remote code execution via multi-segment extension file uploads.

TL;DR

A regression in REDAXO's file extension blocklist logic allows authenticated users with upload privileges to bypass validation using multi-segmented filenames like 'file.php.any.jpg', leading to RCE in certain web server configurations.

⚠️ Exploit Status: POC

Technical Details

CWE ID: CWE-434
Attack Vector: Network (Authenticated)
CVSS v3.1 Score: 7.5 (High)
EPSS Percentile: N/A (Newly registered)
Impact: Arbitrary Remote Code Execution (RCE)
Exploit Status: Proof-of-Concept (PoC) documented
CISA KEV Status: Not Listed

Affected Systems

REDAXO Core (versions 5.18.2 to 5.21.0) with Mediapool addon installed
REDAXO Core: >= 5.18.2, < 5.21.1 (Fixed in: 5.21.1)

Code Analysis

Commit: 462e368

Fix: media upload validation for double extensions

@@ -114,13 +114,13 @@ ... -        foreach ($blockedExtensions as $blockedExtension) {
-            if (str_ends_with($filename, '.' . $blockedExtension)
-                || str_ends_with($filename, '.' . $blockedExtension . '.' . $fileExt)
-            ) {
+        foreach (explode('.', mb_strtolower($filename)) as $segment) {
+            if (in_array($segment, $blockedExtensions, true)) {
                 return false;
             }
         }

Mitigation Strategies

Upgrade REDAXO to version 5.21.1 or higher.
Harden Apache configurations by replacing AddHandler with end-anchored FilesMatch directives.
Disable Apache MultiViews in the directory settings.

Remediation Steps:

Verify current REDAXO version is within the affected range (5.18.2 to 5.21.0).
Backup the application database and filesystem.
Apply the update to REDAXO version 5.21.1.
Review and update Apache configuration files to ensure secure handler mappings.

References

Read the full report for CVE-2026-53599 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community