CVE-2026-53691: Redeight CMS File Upload RCE Vulnerability

CVE-2026-53691 Overview

CVE-2026-53691 is an unrestricted file upload vulnerability in Redeight CMS version 1.0. The flaw resides in the POST /admin/index.php?module=pages&mode=FileAdd endpoint. The application fails to validate file extensions and MIME types on uploaded content. Authenticated attackers can upload arbitrary PHP scripts to the publicly accessible /uploads/files/ directory. The web server executes these scripts directly, yielding remote code execution in the context of the web application. The weakness maps to CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Authenticated attackers can achieve remote code execution on the underlying web server, leading to full compromise of the CMS host and any data it processes.

Affected Products

Redeight CMS version 1.0
Deployments exposing the /admin/index.php administrative interface
Web servers configured to execute PHP files placed under /uploads/files/

Discovery Timeline

2026-06-30 - CVE-2026-53691 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-53691

Vulnerability Analysis

The vulnerability stems from missing server-side validation in the file upload handler exposed at /admin/index.php?module=pages&mode=FileAdd. The endpoint accepts arbitrary files without enforcing an allowlist of extensions or verifying MIME content types. Attackers holding valid administrative session credentials can submit a PHP payload as if it were a benign asset. The uploaded file is stored in /uploads/files/, a directory served directly by the web server with PHP execution enabled. Requesting the uploaded file causes the interpreter to execute the attacker-controlled code. The Exploit Prediction Scoring System reports a probability of 0.488% with a percentile of 38.46 as of 2026-07-02.

Root Cause

Redeight CMS 1.0 relies on the client-supplied filename and content type when persisting uploaded files. There is no extension allowlist, no magic-byte inspection, and no rewrite rule preventing script execution in the destination directory. This combination transforms an authenticated file upload feature into an arbitrary code execution primitive.

Attack Vector

An authenticated attacker sends a multipart POST request to /admin/index.php?module=pages&mode=FileAdd containing a PHP file such as shell.php. The server writes the file to /uploads/files/shell.php. The attacker then issues a GET request to that URL. The web server passes the file to the PHP interpreter, executing attacker commands with the privileges of the web server process. From this position, attackers can pivot to database credentials, read source code, or establish persistence. Additional analysis is available in the CERT Poland CVE Analysis.

No verified proof-of-concept code is published in the referenced advisories, so exploitation details are described in prose rather than reproduced here.

Detection Methods for CVE-2026-53691

Indicators of Compromise

Files with executable extensions such as .php, .phtml, or .phar present in /uploads/files/.
HTTP POST requests to /admin/index.php?module=pages&mode=FileAdd followed by GET requests to newly created files in /uploads/files/.
Web server processes spawning shell interpreters, curl, wget, or reverse-shell binaries.

Detection Strategies

Alert on writes of files with script extensions to any directory under the web root, especially /uploads/.
Correlate administrative logins with subsequent uploads and immediate access to files in upload directories.
Inspect web server access logs for mode=FileAdd requests originating from unexpected source addresses or user agents.

Monitoring Recommendations

Forward web server, PHP-FPM, and application logs to a centralized platform for retention and correlation.
Baseline expected child processes of the web server user and alert on deviations such as /bin/sh or python.
Monitor filesystem integrity on the /uploads/files/ directory to detect unauthorized additions.

How to Mitigate CVE-2026-53691

Immediate Actions Required

Restrict access to /admin/index.php using network controls, VPN, or IP allowlisting until a patched release is deployed.
Audit /uploads/files/ for unauthorized scripts and remove any files that do not match expected content types.
Rotate administrative credentials and session tokens to invalidate accounts that may have been abused.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Operators should track the CERT Poland CVE Analysis for updated vendor guidance and apply fixes as soon as they are released.

Workarounds

Disable PHP execution within /uploads/files/ using web server configuration directives, so uploaded files are served as static content only.
Enforce an extension allowlist and MIME validation in a reverse proxy or Web Application Firewall in front of Redeight CMS.
Store uploaded files outside the web root and serve them through a controlled handler that never invokes the PHP interpreter.

bash

# Apache: prevent PHP execution in the uploads directory
<Directory "/var/www/redeight/uploads/files">
    php_flag engine off
    SetHandler none
    RemoveHandler .php .phtml .phar
    RemoveType .php .phtml .phar
    Require all granted
</Directory>