REDAXO CMS EUVD-2026-51626

Three conditions must simultaneously be true for exploitation to succeed. First, the attacker must hold an authenticated REDAXO backend account with the media[upload] permission explicitly granted - this is not a default public-facing exposure. Second, the web server must be configured with a multi-extension PHP execution handler: specifically Apache mod_mime AddHandler application/x-httpd-php .php (which treats any file containing .php as a segment as executable PHP), or an Apache FilesMatch directive whose regex does not end with a dollar-sign anchor; standard PHP-FPM deployments on nginx or Apache using try_files / proxy_fcgi with exact-path matching are NOT vulnerable. Third, the REDAXO public media/ directory must be reachable over HTTP, which is the default deployment layout. Exploitation is blocked whenever: the attacker lacks a backend account with media[upload] permission; the server runs PHP-FPM with standard try_files routing; the server uses nginx with location ~ \.php$ (end-anchored); the Apache FilesMatch directive is correctly anchored (e.g., <FilesMatch "\.php$">); or direct HTTP access to the media/ directory is restricted or PHP execution is disabled there.

The vendor-assigned CVSS 7.5 vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H is independently defensible. AC:H is appropriate because exploitation is contingent on a non-default Apache server configuration (multi-extension PHP handler); PHP-FPM with standard routing, nginx with location ~ \.php$, or correctly anchored Apache FilesMatch directives are not vulnerable. PR:L reflects the mandatory requirement for a backend account with media[upload] permission, which is not a trivially obtained credential. The full C/I/A:H triad is justified because successful exploitation yields arbitrary PHP code execution as the web-server user. No CISA KEV listing and no independent public exploit repository have been identified, placing real-world exploitation probability in the low-to-moderate range despite the detailed technical disclosure in GHSA-98pp-vccm-qm25, which lowers the research bar for anyone already holding backend access. The primary limiting factor is the intersection of two conditions: holding a privileged backend account AND running a susceptible Apache handler configuration. Defenders on PHP-FPM or nginx deployments face negligible practical risk regardless of patch status.

An attacker holding a REDAXO backend account with media[upload] permission crafts a JPEG/PHP polyglot - a valid JPEG file with embedded PHP code - and names it shell.php.any.jpg, then uploads it through the media pool UI; the isAllowedExtension check passes because the terminal extension is jpg and neither str_ends_with check matches the three-segment pattern. On an Apache server configured with AddHandler application/x-httpd-php .php, the attacker then sends an HTTP GET request to the public URL /media/shell.php.any.jpg, which Apache routes to the PHP interpreter due to the intermediate .php segment, executing the embedded PHP payload as the web-server user. The GHSA advisory provides the exact code path, payload name pattern, and root-cause explanation, materially reducing the effort required to exploit this by any attacker already holding backend credentials.