Skip to content
OpenAdvisories

Package · Packagist

redaxo/source

18 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Clear filters · Feed

  • High 7.5
    CVE-2026-53599

    Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

    REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named she…

    redaxo core redaxo/source Packagist
  • High 8.3
    CVE-2026-21857 Public exploit

    Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

    REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not val…

    redaxo redaxo redaxo/source Packagist
  • High 7.2
    CVE-2025-64050

    REDAXO CMS is vulnerable to RCE attack through its template management component

    A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is execu…

    redaxo/source Packagist
  • High 7.2
    CVE-2024-25298

    Code injection in REDAXO

    An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.

    redaxo/source Packagist