High severity · published May 23, 2026
CVE-2018-25353
Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
8.8
CVSS
0.5%
EPSS
No
On KEV
Description
Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions. Attackers with editor accounts can upload executable files by using obfuscated extensions like php71 or php53 to evade the blacklist filter and execute arbitrary code.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 39% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RC
Redaxo CMS Mediapool · Redaxo
through 5.5.1 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-25353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-25353
redaxo.org
https://redaxo.org
redaxo.org
https://redaxo.org/download/redaxo/5.5.1.zip
www.exploit-db.com
https://www.exploit-db.com/exploits/44891
www.vulncheck.com
https://www.vulncheck.com/advisories/redaxo-cms-mediapool-addon-arbitrary-file-upload