What’s Vulnerable › Vulnerabilities

CVE-2025-27411: REDAXO allows Arbitrary File Upload in the mediapool page

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-03-05 · updated 2026-06-17
• Weakness: CWE-434

Description

REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.

Affected products

• redaxo: before 5.18.3 — fixed in 5.18.3

How to fix

Upgrade to a fixed version: redaxo 5.18.3. Check the vendor advisory for mitigations.

References

• https://github.com/redaxo/redaxo/commit/3b2159bb45da0ab6cfaef5c8cf8b602ee5e2fb37
• https://github.com/redaxo/redaxo/security/advisories/GHSA-wppf-gqj5-fc4f

Get alerted when CVE-2025-27411 or the next vulnerability affects your stack