{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/redaxo/core/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["redaxo/core"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Redaxo"],"content_html":"\u003cp\u003eA security regression in the \u003ccode\u003erex_mediapool::isAllowedExtension\u003c/code\u003e function, introduced in commit \u003ccode\u003e9d008697d\u003c/code\u003e, allows authenticated backend users to bypass filename extension filters within the REDAXO CMS (versions 5.18.2 through 5.21.0). The validator previously utilized a robust \u003ccode\u003estr_contains\u003c/code\u003e check to block forbidden extensions (like .php) anywhere in the filename, but was refactored to use \u003ccode\u003estr_ends_with\u003c/code\u003e logic. This new implementation only checks the final extension and the immediate preceding segment, failing to account for multi-segment extensions like \u003ccode\u003eshell.php.any.jpg\u003c/code\u003e.\u003c/p\u003e\n\u003cp\u003eAuthenticated users with media upload privileges can upload polyglot files containing malicious PHP code. If the underlying web server (typically Apache) is configured with non-anchored PHP handlers (using \u003ccode\u003eAddHandler\u003c/code\u003e or overly broad \u003ccode\u003eFilesMatch\u003c/code\u003e regex), the server will execute the embedded PHP code when the uploaded file is requested, resulting in arbitrary code execution as the web-server user. This vulnerability is tracked as CVE-2026-53599.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker gains access to a REDAXO backend account with the \u003ccode\u003emedia[upload]\u003c/code\u003e permission.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a polyglot file (e.g., \u003ccode\u003eshell.php.any.jpg\u003c/code\u003e) that contains a valid JPEG header followed by arbitrary PHP code.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the Media Pool upload interface and uploads the crafted \u003ccode\u003eshell.php.any.jpg\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003eisAllowedExtension\u003c/code\u003e validator processes the filename, evaluates the final \u003ccode\u003e.jpg\u003c/code\u003e extension, and fails to identify the nested \u003ccode\u003e.php\u003c/code\u003e segment, allowing the upload.\u003c/li\u003e\n\u003cli\u003eThe file is saved to the public \u003ccode\u003emedia/\u003c/code\u003e directory.\u003c/li\u003e\n\u003cli\u003eAttacker sends an HTTP GET request to \u003ccode\u003ehttps://\u0026lt;victim\u0026gt;/media/shell.php.any.jpg\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe Apache web server, due to loose handler configuration, interprets the \u003ccode\u003e.php\u003c/code\u003e segment as a valid PHP execution directive.\u003c/li\u003e\n\u003cli\u003eThe PHP engine executes the embedded payload, granting the attacker RCE.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated backend user to gain arbitrary PHP code execution on the target server. This enables full compromise of the web application, potential lateral movement within the hosting environment, and unauthorized access to data stored in the database and file system. The scope includes any deployment running vulnerable REDAXO versions configured with loose Apache PHP handler mappings.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for detection and remediation:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate REDAXO to version 5.21.1 or later to apply the security patch for CVE-2026-53599.\u003c/li\u003e\n\u003cli\u003eAudit Apache configuration files for \u003ccode\u003eAddHandler\u003c/code\u003e directives or \u003ccode\u003eFilesMatch\u003c/code\u003e regex patterns that lack an end-of-line anchor (\u003ccode\u003e$\u003c/code\u003e), which can cause multi-extension files to be incorrectly parsed as PHP.\u003c/li\u003e\n\u003cli\u003eUse the provided Sigma rule to detect attempts to upload files with suspicious double or multi-extension naming patterns in web server logs or CMS audit logs.\u003c/li\u003e\n\u003cli\u003eImplement strict upload validation on web application firewalls (WAF) to inspect filenames for nested forbidden extensions, specifically targeting the pattern \u003ccode\u003e.*\\.php\\..*\u003c/code\u003e.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-31T19:45:35Z","date_published":"2026-07-31T19:45:35Z","id":"https://feed.craftedsignal.io/briefs/2026-07-redaxo-mediapool-bypass/","summary":"A security regression in Redaxo allows authenticated backend users to achieve RCE by bypassing extension filters using multi-segment filenames on misconfigured Apache web servers.","title":"Redaxo Mediapool File Extension Validation Bypass and RCE","url":"https://feed.craftedsignal.io/briefs/2026-07-redaxo-mediapool-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - Redaxo/Core","version":"https://jsonfeed.org/version/1.1"}