CVE-2025-27411: Redaxo

Medium severity, CVSS 5.4. EPSS: 0.3% chance of exploitation in the next 30 days.

REDAXO is a PHP-based CMS. In Redaxo before 5.18.3, the mediapool/media page is vulnerable to arbitrary file upload. This vulnerability is fixed in 5.18.3.

Affected products

• Redaxo Redaxo: before 5.18.3 (fixed in 5.18.3)

Published 2025-03-05. Last modified 2026-06-17.