PT-2026-43092
CVE-2018-25353
·
Published
2026-05-23
·
Updated
2026-05-23
Description by
CVSS 3.1
8.8
HighMetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions
Redaxo CMS Mediapool Addon versions prior to 5.5.2
Description
An arbitrary file upload issue allows authenticated users with editor accounts to bypass file extension blacklist restrictions. By using obfuscated extensions such as
php71 or php53, attackers can evade the blacklist filter to upload executable files and execute arbitrary code.Recommendations
Update to version 5.5.2 or newer.
Found an issue in the description? Have something to add? Feel free to write us 👾