CVE-2026-53599

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.

Summary

rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the end of the filename or immediately before the final extension. An authenticated backend user with mediapool upload permission can upload a JPEG/PHP polyglot named shell.php.any.jpg and, on web servers whose PHP handler matches .php as any segment (mod_mime AddHandler-style, or any FilesMatch regex without an end anchor), request the file from the public media/ directory to execute arbitrary PHP as the web-server user.

The vulnerable check is a regression introduced in commit 9d008697d (PR #6213, Feb 7 2025), which weakened a previously correct str_contains check into a pair of str_ends_with checks. The earlier check, in place since 2018 specifically to defend against double-extension attacks, would have blocked this payload.

The regression has shipped in every release from 5.18.2 through 5.21.0.

Details

Root cause

At the audited commit 6e0de42, isAllowedExtension performs three checks against the blocked-extension list:

// redaxo/src/addons/mediapool/lib/mediapool.php (104–130) @ 6e0de42
public static function isAllowedExtension(string $filename, array $args = []): bool
{
    $fileExt = mb_strtolower(rex_file::extension($filename));
 
    if ('' === $filename || str_contains($fileExt, ' ') || '' === $fileExt) {
        return false;
    }
 
    if (str_starts_with($fileExt, 'php')) {
        return false;
    }
 
    $blockedExtensions = self::getBlockedExtensions();
    foreach ($blockedExtensions as $blockedExtension) {
        // $blockedExtensions extensions are not allowed within filenames, to prevent double extension vulnerabilities:
        // -> some webspaces execute files named file.php.txt as php
        if (str_ends_with($filename, '.' . $blockedExtension)
            || str_ends_with($filename, '.' . $blockedExtension . '.' . $fileExt)
        ) {
            return false;
        }
    }
 
    $allowedExtensions = self::getAllowedExtensions($args);
    return !count($allowedExtensions) || in_array($fileExt, $allowedExtensions);
}

For shell.php.any.jpg:

1. $fileExt is jpg, so str_starts_with('jpg', 'php') is false.
2. The loop checks two suffix shapes:
   • str_ends_with('shell.php.any.jpg', '.php') — false.
   • str_ends_with('shell.php.any.jpg', '.php.jpg') — false, because the actual chain is .php.any.jpg.
3. Default $allowedExtensions is empty (no widget types arg on the main mediapool upload page), so the function returns true. The defensive comment on lines 119–120 explicitly names the threat model the maintainers are guarding against — "some webspaces execute files named file.php.txt as php". The current check covers that exact two-segment shape but fails for any chain of length three or more in which a blocked extension is not the final segment.

Regression history

Prior to commit 9d008697d (PR #6213, Feb 7 2025) the check was:

if (str_contains($filename, '.' . $blockedExtension)) {
    return false;
}

str_contains('shell.php.any.jpg', '.php') is true, so the prior check would have correctly rejected this payload. The substring form had a false-positive problem with names like foo.json (which contains the substring .js), and the rewrite removed the false positive but also removed the multi-extension protection. The three regression tests added in that commit (foo.js.txt, js_datei.txt, foo.json) do not include a length-three-or-greater chain with a blocked non-terminal segment, so the security regression was not caught by…

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.

Summary

rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the end of the filename or immediately before the final extension. An authenticated backend user with mediapool upload permission can upload a JPEG/PHP polyglot named shell.php.any.jpg and, on web servers whose PHP handler matches .php as any segment (mod_mime AddHandler-style, or any FilesMatch regex without an end anchor), request the file from the public media/ directory to execute arbitrary PHP as the web-server user.

The vulnerable check is a regression introduced in commit 9d008697d (PR #6213, Feb 7 2025), which weakened a previously correct str_contains check into a pair of str_ends_with checks. The earlier check, in place since 2018 specifically to defend against double-extension attacks, would have blocked this payload.

The regression has shipped in every release from 5.18.2 through 5.21.0.

Details

Root cause

At the audited commit 6e0de42, isAllowedExtension performs three checks against the blocked-extension list:

// redaxo/src/addons/mediapool/lib/mediapool.php (104–130) @ 6e0de42
public static function isAllowedExtension(string $filename, array $args = []): bool
{
    $fileExt = mb_strtolower(rex_file::extension($filename));
 
    if ('' === $filename || str_contains($fileExt, ' ') || '' === $fileExt) {
        return false;
    }
 
    if (str_starts_with($fileExt, 'php')) {
        return false;
    }
 
    $blockedExtensions = self::getBlockedExtensions();
    foreach ($blockedExtensions as $blockedExtension) {
        // $blockedExtensions extensions are not allowed within filenames, to prevent double extension vulnerabilities:
        // -> some webspaces execute files named file.php.txt as php
        if (str_ends_with($filename, '.' . $blockedExtension)
            || str_ends_with($filename, '.' . $blockedExtension . '.' . $fileExt)
        ) {
            return false;
        }
    }
 
    $allowedExtensions = self::getAllowedExtensions($args);
    return !count($allowedExtensions) || in_array($fileExt, $allowedExtensions);
}

For shell.php.any.jpg:

1. $fileExt is jpg, so str_starts_with('jpg', 'php') is false.
2. The loop checks two suffix shapes:
   • str_ends_with('shell.php.any.jpg', '.php') — false.
   • str_ends_with('shell.php.any.jpg', '.php.jpg') — false, because the actual chain is .php.any.jpg.
3. Default $allowedExtensions is empty (no widget types arg on the main mediapool upload page), so the function returns true. The defensive comment on lines 119–120 explicitly names the threat model the maintainers are guarding against — "some webspaces execute files named file.php.txt as php". The current check covers that exact two-segment shape but fails for any chain of length three or more in which a blocked extension is not the final segment.

Regression history

Prior to commit 9d008697d (PR #6213, Feb 7 2025) the check was:

if (str_contains($filename, '.' . $blockedExtension)) {
    return false;
}

str_contains('shell.php.any.jpg', '.php') is true, so the prior check would have correctly rejected this payload. The substring form had a false-positive problem with names like foo.json (which contains the substring .js), and the rewrite removed the false positive but also removed the multi-extension protection. The three regression tests added in that commit (foo.js.txt, js_datei.txt, foo.json) do not include a length-three-or-greater chain with a blocked non-terminal segment, so the security regression was not caught by…