A critical security vulnerability involving an arbitrary file upload restriction bypass has been identified, carrying a CVSS v3.1 base score of 7.5 (High severity). The issue stems from inadequate validation logic within multi-segment filename parsing routines, permitting restricted file extension bypasses. Authenticated attackers holding minimal media upload privileges can leverage this flaw to introduce malicious code onto vulnerable deployments. Successful exploitation requires specific web application server handler configurations that evaluate intermediate file extensions. Under these conditions, the vulnerability can culminate in arbitrary code execution within the security context of the underlying web server process.
CVE-2026-53599: This vulnerability represents an arbitrary file upload extension bypass residing in the central media management component of affected web application management systems. The security flaw originates from incomplete multi-segment filename validation logic that fails to flag restricted extensions located prior to intermediate segments in longer extension chains. An authenticated user possessing basic media upload rights can bypass restriction mechanisms by transmitting polyglot files with crafted multi-part extensions. If hosted on web server environments employing multi-extension file handlers, the application executes the embedded script, resulting in full remote code execution and compromised server integrity.[/subscribe_to_unlock_form]
A critical security vulnerability involving an arbitrary file upload restriction bypass has been identified, carrying a CVSS v3.1 base score of 7.5 (High severity). The issue stems from inadequate validation logic within multi-segment filename parsing routines, permitting restricted file extension bypasses. Authenticated attackers holding minimal media upload privileges can leverage this flaw to introduce malicious code onto vulnerable deployments. Successful exploitation requires specific web application server handler configurations that evaluate intermediate file extensions. Under these conditions, the vulnerability can culminate in arbitrary code execution within the security context of the underlying web server process.
CVE-2026-53599: This vulnerability represents an arbitrary file upload extension bypass residing in the central media management component of affected web application management systems. The security flaw originates from incomplete multi-segment filename validation logic that fails to flag restricted extensions located prior to intermediate segments in longer extension chains. An authenticated user possessing basic media upload rights can bypass restriction mechanisms by transmitting polyglot files with crafted multi-part extensions. If hosted on web server environments employing multi-extension file handlers, the application executes the embedded script, resulting in full remote code execution and compromised server integrity.[emaillocker id="1283"]
Administrators of vulnerable deployments should urgently implement vendor-provided software updates to restore full string containment checks on uploaded filenames. Additionally, server configurations must be hardened by enforcing strict single-extension file handling, anchoring regex matches for script interpreters, and disabling execution permissions across public media directories.
We recommend you to update Redaxo to version 5.21.1.
The following reports contain further technical details:
[/emaillocker]