Which versions of Redeight CMS are affected by EUVD-2026-40293?

Redeight CMS 1.0 contains a remote code execution vulnerability in the admin Pages module that allows authenticated administrators to upload and execute arbitrary PHP scripts.

How to fix or mitigate EUVD-2026-40293?

Within 24 hours: (1) Audit all admin user accounts in Redeight CMS 1.0 and revoke unnecessary administrative access; (2) disable the Pages module FileAdd endpoint if functionally feasible; (3) configure the web server to prevent PHP execution within the /uploads/files/ directory via .htaccess or nginx directives. Within 7 days: (1) contact Redeight support to confirm patch availability and timeline; (2) implement web application firewall rules to block file uploads containing PHP extensions to /uploads/; (3) deploy file integrity monitoring alerts on the /uploads/ directory for newly created executable files. Within 30 days: deploy vendor patch immediately upon release, or execute contingency plan to migrate from Redeight CMS 1.0 if patch timeline extends beyond 30 days.

Redeight CMS EUVD-2026-40293

Q: What is the CVSS score of EUVD-2026-40293?

EUVD-2026-40293 has a CVSS 4.0 base score of 8.6 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.5%.

| CVE-2026-53691 HIGH

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-06-30 CERT-PL

GHSA-gxmr-q5p5-p9w5

PHP RCE File Upload Redeight Cms Redeight

8.6

CVSS 4.0 · Vendor: CERT-PL

Severity by source

Vendor (CERT-PL) PRIMARY

8.6 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.8 HIGH

Network-reachable upload with low complexity; description says authenticated so PR:L (not PR:N), attacker uploads own shell so UI:N; RCE gives C/I/A High.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (CERT-PL).

CVSS VectorVendor: CERT-PL

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Generated

Jun 30, 2026 - 12:17 vuln.today

DescriptionCVE.org

An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows authenticated attackers to achieve Remote Code Execution via the POST "/admin/index.php?module=pages&mode=FileAdd" endpoint. The application fails to validate file extensions and MIME types, permitting the upload of arbitrary PHP scripts to the publicly accessible "/uploads/files/" directory where they can be executed directly by the web server.

AnalysisAI

Remote code execution in Redeight CMS 1.0 lets an authenticated attacker upload arbitrary PHP scripts through the admin Pages module's FileAdd endpoint, which performs no extension or MIME-type validation. The uploaded file lands in the web-accessible /uploads/files/ directory and is executed directly by the web server, yielding full server-side code execution. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; EPSS data was not provided.

Technical ContextAI

Redeight CMS is a PHP-based content management system. The flaw is a classic CWE-434 Unrestricted Upload of File with Dangerous Type: the file-management handler reached via POST /admin/index.php?module=pages&mode=FileAdd accepts uploaded files without enforcing an allow-list of extensions or verifying the declared/actual MIME type. Because the destination /uploads/files/ is served by the same Apache/PHP-capable web server and is publicly reachable, a uploaded .php payload becomes a directly requestable web shell. The CPE cpe:2.3:a:redeight:redeight_cms:*:*:*:* identifies the affected component as the Redeight CMS application itself (version 1.0 per the description).

RemediationAI

No vendor-released patch identified at time of analysis, and no fix version is cited in the input, so apply compensating controls until the vendor publishes a fixed release: configure the web server to refuse PHP execution in the upload tree (for Apache, drop a .htaccess in /uploads/ with 'php_admin_flag engine off' or a '<FilesMatch \.ph(p[0-9]?|tml)$> Require all denied </FilesMatch>' block; for nginx, remove the PHP FastCGI handler for that location), which neutralizes the web-shell vector without affecting legitimate static downloads. Additionally restrict access to /admin/index.php?module=pages&mode=FileAdd via IP allow-listing or stronger authentication, and audit /uploads/files/ for already-planted scripts. Trade-off: disabling PHP under /uploads breaks any feature that legitimately serves dynamic content from that path (uncommon for an upload directory). Monitor the CERT-PL advisory (https://cert.pl/posts/2026/06/CVE-2026-53690) for an official patched version, then upgrade as the primary fix.