CVE-2018-25353

HIGH SEVERITY

CVSS Score & Metrics

Base Score

8.8 / 10

Vector String

                                        CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H                                    

Vulnerability Description

Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions. Attackers with editor accounts can upload executable files by using obfuscated extensions like php71 or php53 to evade the blacklist filter and execute arbitrary code.

Vulnerability Details

Published Date

May 23, 2026

Last Modified

May 23, 2026

CWE ID

CWE-863

Source

NVD

External References

https://redaxo.org
https://redaxo.org/download/redaxo/5.5.1.zip
https://www.exploit-db.com/exploits/44891
https://www.vulncheck.com/advisories/redaxo-cms-mediapool-addon-arbitrary-file-upload

CVE-2018-25353

CVSS Score & Metrics

Vulnerability Description

Vulnerability Details

External References

Discussion (0)

Add Comment