CVE-2018-25353— Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
Quick assessment
Affected
Redaxo Redaxo CMS Mediapool
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Yakamara Media Redaxo CMS Mediapool Addon是Yakamara Media公司的一个REDAXO内容管理系统的媒体资源管理扩展。 Yakamara Media Redaxo CMS Mediapool Addon 5.5.1及之前版本存在安全漏洞，该漏洞源于任意文件上传，可能导致已认证用户通过使用混淆扩展名绕过文件扩展名黑名单限制并执行任意代码。
Possible ATT&CK Techniques 1 AI
T1505.003 · Web ShellAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Redaxo | Redaxo CMS Mediapool | ≤ 5.5.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2018-25353
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload
Source: CVE Program / CVE List V5
Vulnerability Description
Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions. Attackers with editor accounts can upload executable files by using obfuscated extensions like php71 or php53 to evade the blacklist filter and execute arbitrary code.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
授权机制不正确
Source: CVE Program / CVE List V5
Vulnerability Title
Yakamara Media Redaxo CMS Mediapool Addon 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Yakamara Media Redaxo CMS Mediapool Addon是Yakamara Media公司的一个REDAXO内容管理系统的媒体资源管理扩展。 Yakamara Media Redaxo CMS Mediapool Addon 5.5.1及之前版本存在安全漏洞，该漏洞源于任意文件上传，可能导致已认证用户通过使用混淆扩展名绕过文件扩展名黑名单限制并执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Redaxo | Redaxo CMS Mediapool | 0 ~ 5.5.1 | - |
|
II. Public POCs for CVE-2018-25353
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2018-25353
请登录查看更多情报信息。
Vendor Advisories for CVE-2018-25353 (1)
-
🔗 Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload | Advisories | VulnCheck third-party-advisory
Exploits & Public PoCs for CVE-2018-25353 (1)
Vendor Pages for CVE-2018-25353 (1)
Other References for CVE-2018-25353 (1)
IV. Related Vulnerabilities
Same vendor: Redaxo
-
CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-s -
CVE-2016-20053
Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint -
CVE-2026-21857
Redaxo has Path Traversal in Backup Addon Leading to Arbitra -
CVE-2025-66026
REDAXO is Vulnerable to Reflected XSS in Mediapool Info Bann -
CVE-2025-27412
REDAXO allows Authenticated Reflected Cross Site Scripting -
Same weakness: CWE-863
-
CVE-2026-56710
Grav Login Plugin before 1.0.16 Privilege Escalation via Unl -
CVE-2026-75542
OAuth token exchange grants repository scopes for organizati -
CVE-2026-77923
Dolibarr 21.0.0 < 24.0.0 Authorization Bypass via clonetasks -
CVE-2026-71510
Dolibarr < 24.0.0 Users REST API SQL Injection via filter pa -
CVE-2026-71506
Dolibarr < 24.0.0 Payments REST API Improper Authorization v
V. Comments for CVE-2018-25353
No comments yet