CVE-2018-25353— Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
Possible ATT&CK Techniques 1AI
T1505.003 · Web ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Redaxo | Redaxo CMS Mediapool | ≤ 5.5.1 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2018-25353
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
Source: NVD (National Vulnerability Database)
Vulnerability Description
Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions. Attackers with editor accounts can upload executable files by using obfuscated extensions like php71 or php53 to evade the blacklist filter and execute arbitrary code.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
授权机制不正确
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Redaxo | Redaxo CMS Mediapool | 0 ~ 5.5.1 | - |
II. Public POCs for CVE-2018-25353
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-25353
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-25353 (1)
- Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload | Advisories | VulnCheckthird-party-advisory
Exploits & Public PoCs for CVE-2018-25353 (1)
Vendor Pages for CVE-2018-25353 (1)
Other References for CVE-2018-25353 (1)
IV. Related Vulnerabilities
Same vendor: Redaxo
- CVE-2016-20053
Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint - CVE-2026-21857
Redaxo has Path Traversal in Backup Addon Leading to Arbitra - CVE-2025-66026
REDAXO is Vulnerable to Reflected XSS in Mediapool Info Bann - CVE-2025-27412
REDAXO allows Authenticated Reflected Cross Site Scripting - - CVE-2025-27411
REDAXO allows Arbitrary File Upload in the mediapool page
Same weakness: CWE-863
- CVE-2026-6406
Docker Desktop Enhanced Container Isolation bypass via --use - CVE-2026-39966
TypeBot: Async filter() bypasses authorization, allowing IDO - CVE-2026-28735
GitHub OAuth Scope Validation - CVE-2026-47102
LiteLLM < 1.83.10 Privilege Escalation via User Update - CVE-2026-47101
LiteLLM < 1.83.14 Privilege Escalation via API Key Generatio
V. Comments for CVE-2018-25353
No comments yet