CVE-2026-53599
1 advisory.
Packagist/redaxo/source CVE-2026-53599: high 7.5, EPSS 0.51%
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
Action: Upgrade redaxo/source to 5.21.1 or later.
composer require redaxo/source:5.21.1Affected
| introduced | fixed | last affected |
|---|---|---|
| 5.18.2 | 5.21.1 | - |
Fixed versions
| 5.21.1 |
Sources
- osv: GHSA-98pp-vccm-qm25
- https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25
- https://github.com/redaxo/core/pull/6538
- https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340
- https://github.com/redaxo/core
- https://github.com/redaxo/core/releases/tag/5.21.1
CVE-2026-53599 · published · modified · JSON