CVE-2018-25353
Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
- State
- Published
- Severity
- 8.7 High
- Published
- May 23, 2026
- Updated
- May 26, 2026
- Reserved
- May 23, 2026
Description
Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions. Attackers with editor accounts can upload executable files by using obfuscated extensions like php71 or php53 to evade the blacklist filter and execute arbitrary code.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 8.7 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 8.8 High | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H | VulnCheck |
Weaknesses
- CWE-863 Incorrect Authorization
Affected Products
| Product | Versions |
|---|---|
Redaxo CMS MediapoolRedaxo |
|
References
- ExploitDB-44891exploit
- Official Product Homepageproduct
- Product Referenceproduct
- VulnCheck Advisory: Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Uploadthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.