Search

Find a vulnerability

Search criteria

    10 vulnerabilities found for core by redaxo

    CVE-2026-63002 (GCVE-0-2026-63002)

    Vulnerability from nvd – Published: 2026-09-23 14:05 – Updated: 2026-09-23 14:05
    VLAI
    Title
    REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
    Summary
    REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
    Severity
    4.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: < 5.21.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:05:39.056Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6581",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6581"
        },
        {
          "name": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-w998-qmw9-mf4m",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63002",
    "datePublished": "2026-09-23T14:05:39.056Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T14:05:39.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-63001 (GCVE-0-2026-63001)

    Vulnerability from nvd – Published: 2026-09-23 14:03 – Updated: 2026-09-23 14:03
    VLAI
    Title
    REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
    Summary
    REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
    Severity
    4.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: < 5.21.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator\u0027s browser when that administrator tries to delete media referenced by the type\u0027s effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:03:12.137Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6581",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6581"
        },
        {
          "name": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-mf2p-wjp4-99pq",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63001",
    "datePublished": "2026-09-23T14:03:12.137Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T14:03:12.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-63000 (GCVE-0-2026-63000)

    Vulnerability from nvd – Published: 2026-09-23 14:08 – Updated: 2026-09-23 14:08
    VLAI
    Title
    REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
    Summary
    REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: < 5.21.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator\u0027s browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator\u0027s intent. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:08:42.402Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6579",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6579"
        },
        {
          "name": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-m8r3-22v6-g877",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63000",
    "datePublished": "2026-09-23T14:08:42.402Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T14:08:42.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-62998 (GCVE-0-2026-62998)

    Vulnerability from nvd – Published: 2026-09-23 14:07 – Updated: 2026-09-23 15:22
    VLAI
    Title
    REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
    Summary
    REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-23 15:22 UTC
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: < 5.21.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62998",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T15:22:29.404424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T15:22:46.380Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:07:04.529Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6580",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6580"
        },
        {
          "name": "https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-4f5f-j737-pm58",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62998",
    "datePublished": "2026-09-23T14:07:04.529Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T15:22:46.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-53599 (GCVE-0-2026-53599)

    Vulnerability from nvd – Published: 2026-07-31 19:43 – Updated: 2026-07-31 21:39
    VLAI
    Title
    Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
    Summary
    REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-31 20:11 UTC
    CWE
    • CWE-434 - Unrestricted Upload of File with Dangerous Type
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: >= 5.18.2, < 5.21.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53599",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T20:11:41.826930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T21:39:28.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.18.2, \u003c 5.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T19:43:15.663Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6538",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6538"
        },
        {
          "name": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.1"
        }
      ],
      "source": {
        "advisory": "GHSA-98pp-vccm-qm25",
        "discovery": "UNKNOWN"
      },
      "title": "Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53599",
    "datePublished": "2026-07-31T19:43:15.663Z",
    "dateReserved": "2026-06-09T19:39:52.404Z",
    "dateUpdated": "2026-07-31T21:39:28.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-63000 (GCVE-0-2026-63000)

    Vulnerability from cvelistv5 – Published: 2026-09-23 14:08 – Updated: 2026-09-23 14:08
    VLAI
    Title
    REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates
    Summary
    REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.
    Severity
    6.4 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L
    CWE
    • CWE-352 - Cross-Site Request Forgery (CSRF)
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: < 5.21.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator\u0027s browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator\u0027s intent. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352: Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:08:42.402Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6579",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6579"
        },
        {
          "name": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-m8r3-22v6-g877",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63000",
    "datePublished": "2026-09-23T14:08:42.402Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T14:08:42.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-62998 (GCVE-0-2026-62998)

    Vulnerability from cvelistv5 – Published: 2026-09-23 14:07 – Updated: 2026-09-23 15:22
    VLAI
    Title
    REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration
    Summary
    REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.
    Severity
    4.3 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
    SSVC
    Exploitation: poc Automatable: no Technical Impact: partial
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-09-23 15:22 UTC
    CWE
    • CWE-20 - Improper Input Validation
    • CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: < 5.21.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-62998",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T15:22:29.404424Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T15:22:46.380Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:07:04.529Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6580",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6580"
        },
        {
          "name": "https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-4f5f-j737-pm58",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-62998",
    "datePublished": "2026-09-23T14:07:04.529Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T15:22:46.380Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-63002 (GCVE-0-2026-63002)

    Vulnerability from cvelistv5 – Published: 2026-09-23 14:05 – Updated: 2026-09-23 14:05
    VLAI
    Title
    REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
    Summary
    REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
    Severity
    4.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: < 5.21.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:05:39.056Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6581",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6581"
        },
        {
          "name": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-w998-qmw9-mf4m",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63002",
    "datePublished": "2026-09-23T14:05:39.056Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T14:05:39.056Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-63001 (GCVE-0-2026-63001)

    Vulnerability from cvelistv5 – Published: 2026-09-23 14:03 – Updated: 2026-09-23 14:03
    VLAI
    Title
    REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
    Summary
    REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
    Severity
    4.8 (Medium)
    CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
    CWE
    • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: < 5.21.2
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator\u0027s browser when that administrator tries to delete media referenced by the type\u0027s effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T14:03:12.137Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6581",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6581"
        },
        {
          "name": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
        }
      ],
      "source": {
        "advisory": "GHSA-mf2p-wjp4-99pq",
        "discovery": "UNKNOWN"
      },
      "title": "REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-63001",
    "datePublished": "2026-09-23T14:03:12.137Z",
    "dateReserved": "2026-07-14T23:10:57.032Z",
    "dateUpdated": "2026-09-23T14:03:12.137Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-53599 (GCVE-0-2026-53599)

    Vulnerability from cvelistv5 – Published: 2026-07-31 19:43 – Updated: 2026-07-31 21:39
    VLAI
    Title
    Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
    Summary
    REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.
    Severity
    7.5 (High)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
    SSVC
    Exploitation: poc Automatable: no Technical Impact: total
    CISA Coordinator · CISA-ADP (v2.0.3)
    Decision recorded 2026-07-31 20:11 UTC
    CWE
    • CWE-434 - Unrestricted Upload of File with Dangerous Type
    Assigner
    References
    Impacted products
    Vendor Product Version
    redaxo core Affected: >= 5.18.2, < 5.21.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53599",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T20:11:41.826930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T21:39:28.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.18.2, \u003c 5.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T19:43:15.663Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6538",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6538"
        },
        {
          "name": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.1"
        }
      ],
      "source": {
        "advisory": "GHSA-98pp-vccm-qm25",
        "discovery": "UNKNOWN"
      },
      "title": "Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53599",
    "datePublished": "2026-07-31T19:43:15.663Z",
    "dateReserved": "2026-06-09T19:39:52.404Z",
    "dateUpdated": "2026-07-31T21:39:28.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}