CVE-2026-53599 in Redaxo
Summary
by MITRE • 07/31/2026
REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/04/2026
The vulnerability exists within REDAXO CMS versions 5.18.2 through 5.21.1 where the rex_mediapool::isAllowedExtension function fails to properly validate file extensions during media uploads. This flaw allows authenticated backend users with media[upload] permissions to bypass security restrictions by uploading specially crafted files that appear to be legitimate JPEG images but contain malicious PHP code. The attack vector exploits the way web servers handle multi-extension PHP handlers, where files with extensions like shell.php.any.jpg can be executed as PHP scripts when processed by the web server.
The technical implementation of this vulnerability stems from insufficient input validation within the media upload functionality. When a user uploads a file named shell.php.any.jpg, the system incorrectly validates the extension based on the final component rather than examining the complete file path and content. This oversight allows attackers to leverage the PHP handler configuration where multiple extensions are processed in sequence, effectively executing the embedded PHP code as the web server user account.
This vulnerability has significant operational impact as it provides authenticated users with a means to achieve remote code execution on the web server. The attacker can execute arbitrary PHP commands with the privileges of the web server process, potentially leading to complete system compromise. The vulnerability affects the integrity and confidentiality of the entire CMS installation, as attackers could exfiltrate sensitive data, modify content, or establish persistent access through backdoor scripts.
The flaw aligns with CWE-434 Unrestricted Upload of File with Dangerous Type, which specifically addresses insecure file upload mechanisms that allow malicious files to be uploaded and executed. From an ATT&CK perspective, this vulnerability maps to T1505.003 Server Software Component and T1078 Valid Accounts, as it leverages legitimate backend user credentials to gain elevated privileges. The attack requires minimal sophistication beyond basic knowledge of file extension handling and web server configurations.
Mitigation strategies include updating to version 5.21.1 or later where the vulnerability has been patched, implementing stricter file validation mechanisms that examine complete file paths rather than just extensions, and configuring web servers to properly handle multi-extension files. Additional protective measures involve restricting file upload permissions to minimal required levels, implementing content-type checks in addition to extension validation, and deploying web application firewalls that can detect and block suspicious upload patterns. Organizations should also monitor for unusual upload activities and maintain regular security audits of their CMS installations.