{"id":"CVE-2025-27411","aliases":["EUVD-2025-6166","GHSA-wppf-gqj5-fc4f"],"status":"published","title":"REDAXO allows Arbitrary File Upload in the mediapool page","description":"REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00281,"percentile":0.20846,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-434"],"published":"2025-03-05T15:42:29Z","modified":"2026-10-28T02:30:39Z","fixes":[{"ecosystem":"Packagist","package":"redaxo/source","fixed_in":["5.18.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"redaxo/source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.3"}]}]},{"source":"osv","ecosystem":"Packagist","package":"redaxo/source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.18.3"}]}],"versions":["5.10.0","5.10.0-beta1","5.10.0-beta2","5.10.1","5.11.0","5.11.0-beta1","5.11.1","5.11.2","5.12.0","5.12.0-beta1","5.12.0-beta2","5.12.0-beta3","5.12.1","5.13.0","5.13.0-beta1","5.13.0-beta2","5.13.1","5.13.2","5.13.3","5.14.0","5.14.0-beta1","5.14.0-beta2","5.14.1","5.14.2","5.14.3","5.15.0","5.15.0-beta1","5.15.1","5.16.0","5.16.0-beta1","5.16.1","5.17.0","5.17.1","5.18.0","5.18.1","5.18.2"]}],"products":[{"vendor":"redaxo","product":"redaxo"}],"references":[{"url":"https://github.com/redaxo/redaxo/security/advisories/GHSA-wppf-gqj5-fc4f","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/redaxo/redaxo/commit/3b2159bb45da0ab6cfaef5c8cf8b602ee5e2fb37","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-27411","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wppf-gqj5-fc4f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27411.json","tags":["advisory"]},{"url":"https://github.com/redaxo/redaxo","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2025-27411","title":"REDAXO allows Arbitrary File Upload in the mediapool page","description":"REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.","status":"published","published":"2025-03-05T15:42:29.888Z","modified":"2025-03-06T22:00:09.152Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:32:42.411662Z"}],"euvd":[{"id":"EUVD-2025-6166","description":"REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.","status":"published","published":"2025-03-05T15:42:29Z","modified":"2025-03-06T22:00:09Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:53:11.059252Z"}],"ghsa":[{"id":"GHSA-wppf-gqj5-fc4f","title":"REDAXO allows Arbitrary File Upload in the mediapool page","description":"### Summary\nAn arbitrary file upload vulnerability was identified in the redaxo. This flaw permits users to upload malicious files, which can lead to JavaScript code execution and distribute malware. \n\n### Details\nOn the latest version of Redaxo, v5.18.2, the mediapool/media page is vulnerable to  arbitrary file upload.\n\n### PoC\n1. Log in to the portal then navigate to `Mediapool`.\n2. Upload a png file (ex: poc.png)\n\n![1](https://github.com/user-attachments/assets/e9165434-d2cd-437b-87a3-f9527d4f3070)\n\n\n3. Intercept the upload HTTP request on burp suite and change `filename: poc.1html`,  `Content-Type:image/html` and insert the malicious html code. (ex: `\u003cIFRAME SRC=\"javascript:alert(1);\"\u003e\u003c/IFRAME\u003e`) \n\n![2](https://github.com/user-attachments/assets/f8da0e6b-e807-46be-a867-dc31b1e13e57)\n\n4. Forward the request.\n\n5. Navigate to the file.\n\n![3](https://github.com/user-attachments/assets/4c44c5cf-8467-452d-b249-cf2d72e0d328)\n![4](https://github.com/user-attachments/assets/29db80e3-a5b9-4354-a292-c1ae7189931a)\n\n\n### Impact\nExploiting an arbitrary file upload vulnerability enables attackers to execute malicious code on a server.","status":"published","published":"2025-03-05T18:31:35Z","modified":"2025-03-05T19:30:39Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:38:34.185137Z"}],"nvd":[{"id":"CVE-2025-27411","description":"REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.","status":"published","published":"2025-03-05T16:15:40.31Z","modified":"2026-06-17T09:03:32.22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T14:10:53.101324Z"}],"osv":[{"id":"CVE-2025-27411","title":"REDAXO allows Arbitrary File Upload in the mediapool page","description":"REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.","status":"published","published":"2025-03-05T15:42:29.888Z","modified":"2026-10-28T02:30:39.859630868Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:44:47.386092Z"},{"id":"GHSA-wppf-gqj5-fc4f","title":"REDAXO allows Arbitrary File Upload in the mediapool page","description":"### Summary\nAn arbitrary file upload vulnerability was identified in the redaxo. This flaw permits users to upload malicious files, which can lead to JavaScript code execution and distribute malware. \n\n### Details\nOn the latest version of Redaxo, v5.18.2, the mediapool/media page is vulnerable to  arbitrary file upload.\n\n### PoC\n1. Log in to the portal then navigate to `Mediapool`.\n2. Upload a png file (ex: poc.png)\n\n![1](https://github.com/user-attachments/assets/e9165434-d2cd-437b-87a3-f9527d4f3070)\n\n\n3. Intercept the upload HTTP request on burp suite and change `filename: poc.1html`,  `Content-Type:image/html` and insert the malicious html code. (ex: `\u003cIFRAME SRC=\"javascript:alert(1);\"\u003e\u003c/IFRAME\u003e`) \n\n![2](https://github.com/user-attachments/assets/f8da0e6b-e807-46be-a867-dc31b1e13e57)\n\n4. Forward the request.\n\n5. Navigate to the file.\n\n![3](https://github.com/user-attachments/assets/4c44c5cf-8467-452d-b249-cf2d72e0d328)\n![4](https://github.com/user-attachments/assets/29db80e3-a5b9-4354-a292-c1ae7189931a)\n\n\n### Impact\nExploiting an arbitrary file upload vulnerability enables attackers to execute malicious code on a server.","status":"published","published":"2025-03-05T18:31:35Z","modified":"2025-03-05T19:45:42.829389Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-434"],"updated_at":"2026-11-02T15:46:58.767335Z"}]}}