Redaxo CMS Mediapool Addon prior to version 5.5.1 includes an arbitrary file upload flaw that allows authenticated editor users to bypass the extension blacklist. By uploading files with obfuscated extensions such as php71 or php53, attackers can place executable code on the server and subsequently run it. The weakness is a flaw in input validation (CWE‑863), enabling an attacker to alter the expected behavior of the upload routine.

The vulnerability afflicts Redaxo CMS Mediapool Addon version 5.5.1 and all earlier releases. Users running Redaxo CMS Mediapool on any environment that provides editor-level access are potentially exposed.

The CVSS v3 score of 8.7 reflects a high severity, with remote code execution possible from an authenticated session. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits at the time of this analysis. However, the attack path only requires an editor account, a role commonly granted in many installations, making the conditions for exploitation relatively low-cost for the attacker.