CVE-2026-53599

CVE-2026-53599 affects REDAXO CMS versions 5.18.2–5.21.1 where rex_mediapool::isAllowedExtension lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg. On servers with multi-extension PHP handlers, this can be executed as the web serve...