{"action":"Upgrade redaxo/source to 5.18.3 or later.","affected":[{"fixed":"5.18.3","introduced":"0"}],"component":"redaxo/source","cve_ids":["CVE-2025-27411"],"ecosystem":"Packagist","epss":0.00281,"exploited":false,"fixed_versions":["5.18.3"],"ghsa_id":"GHSA-wppf-gqj5-fc4f","id":"tcs_01M5KFA8PZM255SX4ACY9H39ZA","modified_at":"2025-03-05T19:45:42.829389Z","published_at":"2025-03-05T18:31:35Z","references":["https://osv.dev/vulnerability/GHSA-wppf-gqj5-fc4f","https://github.com/redaxo/redaxo/security/advisories/GHSA-wppf-gqj5-fc4f","https://nvd.nist.gov/vuln/detail/CVE-2025-27411","https://github.com/redaxo/redaxo/commit/3b2159bb45da0ab6cfaef5c8cf8b602ee5e2fb37","https://github.com/redaxo/redaxo"],"severity":{"label":"medium","score":5.4},"sources":[{"source":"osv","source_id":"GHSA-wppf-gqj5-fc4f","url":"https://osv.dev/vulnerability/GHSA-wppf-gqj5-fc4f"}],"summary":"REDAXO allows Arbitrary File Upload in the mediapool page"}