CVE-2026-53599: REDAXO CMS RCE Vulnerability

CVE-2026-53599 Overview

CVE-2026-53599 affects REDAXO, a PHP-based content management system, in versions 5.18.2 through 5.21.0. The rex_mediapool::isAllowedExtension function in redaxo/src/addons/mediapool/lib/mediapool.php fails to detect dangerous extensions embedded as middle segments of a filename. An authenticated backend user with media[upload] permission can upload a JPEG/PHP polyglot named shell.php.any.jpg. Web servers configured with multi-extension PHP handlers then execute the file as the web-server user. The issue is fixed in version 5.21.1 and is categorized under [CWE-434: Unrestricted Upload of File with Dangerous Type].

Critical Impact
Authenticated backend users can achieve arbitrary PHP code execution on affected web servers through polyglot file uploads that bypass the extension blocklist.

Affected Products

REDAXO core 5.18.2 through 5.21.0
REDAXO mediapool addon (bundled with core)
Deployments on web servers with multi-extension PHP handlers (for example, Apache with AddHandler or legacy mod_php configurations)

Discovery Timeline

2026-07-31 - CVE-2026-53599 published to NVD
2026-07-31 - Last updated in NVD database
Fix released - REDAXO core version 5.21.1 available on GitHub

Technical Details for CVE-2026-53599

Vulnerability Analysis

The rex_mediapool::isAllowedExtension method enforces a blocklist of dangerous extensions such as php. The pre-patch logic used str_ends_with to check whether the filename ended with a blocked extension, or whether the filename matched the pattern *.php.<ext>. This narrow check missed filenames containing three or more dot-separated segments, such as shell.php.any.jpg.

When the target web server is configured with a multi-extension PHP handler, Apache and similar servers walk the filename segments and dispatch any file containing a .php segment to the PHP interpreter. A JPEG/PHP polyglot placed in the media pool becomes executable as the web-server user, granting arbitrary code execution within the application context.

Root Cause

The extension validation matched only the final and second-to-last filename segments. It did not iterate all dot-separated segments, so blocked extensions embedded in the middle of a filename were accepted. The bug is a classic unrestricted-upload flaw driven by insufficient filename parsing.

Attack Vector

The attacker requires an authenticated REDAXO backend account with media[upload] permission. They craft a polyglot file that is both a valid JPEG and contains executable PHP payload, then name it with an interior .php segment such as shell.php.any.jpg. After upload, the attacker requests the file over HTTP. Servers with multi-extension PHP handlers execute the payload as the web-server user, yielding remote code execution.

php

            return false;
        }

+        // A blocked extension must not appear as a dot-separated segment anywhere in the filename,
+        // to prevent double/multi extension vulnerabilities: some webspaces execute a file named
+        // e.g. `foo.php.txt` or `foo.php.any.jpg` as php. Matching whole segments (instead of a
+        // substring) avoids false positives like `foo.json` (contains `.js`) or `js_datei.txt`.
        $blockedExtensions = self::getBlockedExtensions();
-        foreach ($blockedExtensions as $blockedExtension) {
-            // $blockedExtensions extensions are not allowed within filenames, to prevent double extension vulnerabilities:
-            // -> some webspaces execute files named file.php.txt as php
-            if (str_ends_with($filename, '.' . $blockedExtension) // Prüfe ob der String mit der verbotenen Endung endet
-                || str_ends_with($filename, '.' . $blockedExtension . '.' . $fileExt) // prüfe ob es keine doppelte Endung der Form *.php.ext gibt
-            ) {
+        foreach (explode('.', mb_strtolower($filename)) as $segment) {
+            if (in_array($segment, $blockedExtensions, true)) {
                return false;
            }
        }

Source: GitHub Commit 462e368. The patch replaces suffix checks with iteration over every dot-separated segment using explode('.', mb_strtolower($filename)) and in_array against the blocklist.

Detection Methods for CVE-2026-53599

Indicators of Compromise

Files in the REDAXO media/ directory whose names contain an interior .php, .phtml, .phar, or similar segment (for example, shell.php.any.jpg)
Web-server access logs showing GET or POST requests to /media/*.php.*.jpg or similar multi-extension paths
Newly created PHP processes spawned by the web-server user immediately after a media upload event
Outbound network connections from the web-server process to unfamiliar external hosts following an upload

Detection Strategies

Scan the REDAXO media directory recursively for filenames containing a blocked extension as any dot-separated segment, not just as a suffix
Inspect REDAXO backend audit logs for uploads by accounts with media[upload] permission and correlate with subsequent HTTP requests to those file paths
Alert on Apache or Nginx handler dispatch to files whose canonical MIME type is image/* but whose response was generated by the PHP interpreter

Monitoring Recommendations

Monitor for child processes spawned by httpd, apache2, nginx, or php-fpm that execute shells such as /bin/sh, bash, nc, python, or curl
Track file-create events in the web root and media directories, and flag filenames with more than two extension segments
Ingest web-server access logs into a central log store and search for HTTP 200 responses to requests targeting files with mixed image and script extensions

How to Mitigate CVE-2026-53599

Immediate Actions Required

Upgrade REDAXO core to version 5.21.1 or later, available from the GitHub Release 5.21.1 page
Audit backend accounts that hold media[upload] permission and revoke it from users who do not require media management
Review the media directory for suspicious multi-extension filenames and remove any unauthorized files
Rotate credentials and secrets accessible to the web-server user if a compromise is suspected

Patch Information

The fix is committed in GitHub Commit 462e368 and merged through GitHub Pull Request #6538. The patched rex_mediapool::isAllowedExtension iterates every dot-separated filename segment and rejects the upload if any segment matches the blocked-extension list. See GitHub Security Advisory GHSA-98pp-vccm-qm25 for full advisory details.

Workarounds

Reconfigure the web server so only files ending exactly in .php are dispatched to the PHP interpreter; disable AddHandler or AddType directives that match multi-extension patterns
Deny script execution within the REDAXO media directory using a location block or .htaccess rule that sets SetHandler none and php_flag engine off
Restrict media[upload] permission to trusted administrators until the patch is applied

bash

# Apache: prevent PHP execution within the REDAXO media directory
<Directory "/var/www/redaxo/media">
    php_admin_flag engine off
    SetHandler none
    RemoveHandler .php .phtml .phar
    RemoveType .php .phtml .phar
    <FilesMatch "\.(php|phtml|phar)($|\.)">
        Require all denied
    </FilesMatch>
</Directory>