CVE-2018-25353 - CVE House
Back to Database
Status published High CVE-2018-25353

Redaxo CMS Mediapool Addon 5.5.1 Arbitrary File Upload

Vulnerability Description

Redaxo CMS Mediapool Addon 5.5.1 and older contains an arbitrary file upload vulnerability that allows authenticated users to bypass file extension blacklist restrictions. Attackers with editor accounts can upload executable files by using obfuscated extensions like php71 or php53 to evade the blacklist filter and execute arbitrary code.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25353

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • mn@HackerWerkstatt

References

More from Redaxo

View All →
CVE-2024-13209
Redaxo CMS Structure Management Page index.php cross site scripting
Medium 5.1
CVE-2016-20053
Redaxo CMS 5.2 Cross-Site Request Forgery via users endpoint
Medium 6.9

Affected Vendor

Affected Software

Redaxo CMS Mediapool
Vulnerable Versions:
0

Timeline

Official Publish: May 23rd, 2026
Last Modified: May 26th, 2026
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-863

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1098 Account Manipulation
Defense Evasion