Redaxo Mediapool File Extension Validation Bypass and RCE

A security regression in the rex_mediapool::isAllowedExtension function, introduced in commit 9d008697d, allows authenticated backend users to bypass filename extension filters within the REDAXO CMS (versions 5.18.2 through 5.21.0). The validator previously utilized a robust str_contains check to block forbidden extensions (like .php) anywhere in the filename, but was refactored to use str_ends_with logic. This new implementation only checks the final extension and the immediate preceding segment, failing to account for multi-segment extensions like shell.php.any.jpg.

Authenticated users with media upload privileges can upload polyglot files containing malicious PHP code. If the underlying web server (typically Apache) is configured with non-anchored PHP handlers (using AddHandler or overly broad FilesMatch regex), the server will execute the embedded PHP code when the uploaded file is requested, resulting in arbitrary code execution as the web-server user. This vulnerability is tracked as CVE-2026-53599.

Attack Chain

1. Attacker gains access to a REDAXO backend account with the media[upload] permission.
2. Attacker crafts a polyglot file (e.g., shell.php.any.jpg) that contains a valid JPEG header followed by arbitrary PHP code.
3. Attacker navigates to the Media Pool upload interface and uploads the crafted shell.php.any.jpg.
4. The isAllowedExtension validator processes the filename, evaluates the final .jpg extension, and fails to identify the nested .php segment, allowing the upload.
5. The file is saved to the public media/ directory.
6. Attacker sends an HTTP GET request to https://<victim>/media/shell.php.any.jpg.
7. The Apache web server, due to loose handler configuration, interprets the .php segment as a valid PHP execution directive.
8. The PHP engine executes the embedded payload, granting the attacker RCE.

Impact

Successful exploitation allows an authenticated backend user to gain arbitrary PHP code execution on the target server. This enables full compromise of the web application, potential lateral movement within the hosting environment, and unauthorized access to data stored in the database and file system. The scope includes any deployment running vulnerable REDAXO versions configured with loose Apache PHP handler mappings.

Recommendation

Prioritized actions for detection and remediation:

• Update REDAXO to version 5.21.1 or later to apply the security patch for CVE-2026-53599.
• Audit Apache configuration files for AddHandler directives or FilesMatch regex patterns that lack an end-of-line anchor ($), which can cause multi-extension files to be incorrectly parsed as PHP.
• Use the provided Sigma rule to detect attempts to upload files with suspicious double or multi-extension naming patterns in web server logs or CMS audit logs.
• Implement strict upload validation on web application firewalls (WAF) to inspect filenames for nested forbidden extensions, specifically targeting the pattern .*\.php\..*.