CVE-2025-27411: REDAXO allows Arbitrary File Upload in the mediapool page
Summary An arbitrary file upload vulnerability was identified in the redaxo. This flaw permits users to upload malicious files, which can lead to JavaScript code execution and distribute malware.
Details On the latest version of Redaxo, v5.18.2, the mediapool/media page is vulnerable to arbitrary file upload.
PoC 1. Log in to the portal then navigate to Mediapool. 2. Upload a png file (ex: poc.png)
!1
3. Intercept the upload HTTP request on burp suite and change filename: poc.1html, Content-Type:image/html and insert the malicious html code. (ex: <IFRAME SRC="javascript:alert(1);"></IFRAME>)
!2
4. Forward the request.
5. Navigate to the file.
!3 !4
Impact Exploiting an arbitrary file upload vulnerability enables attackers to execute malicious code on a server.
Other sources
REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/redaxo/sourceto a version that resolves this vulnerability.Fixed in 5.18.3 - Upgrade
Upgrade
redaxoto a version that resolves this vulnerability.Fixed in 5.18.3 - Operational
If any malicious file upload attempts were made, review the Redaxo mediapool and remove any unexpected uploaded files (e.g., files resembling poc.1html/poc.png) and validate that the uploaded content is no longer accessible after upgrading to Redaxo 5.18.3.
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27411?
CVE-2025-27411 is considered a high severity vulnerability due to its potential for arbitrary file upload.
How do I fix CVE-2025-27411?
To fix CVE-2025-27411, upgrade to REDAXO version 5.18.3 or later.
What type of vulnerability is CVE-2025-27411?
CVE-2025-27411 is an arbitrary file upload vulnerability affecting the mediapool/media page in REDAXO CMS.
Which versions of REDAXO are affected by CVE-2025-27411?
Versions of REDAXO prior to 5.18.3 are affected by CVE-2025-27411.
Can CVE-2025-27411 lead to remote code execution?
Yes, CVE-2025-27411 could potentially allow attackers to execute arbitrary code on the server through file uploads.