The vulnerability is a bypass of the isAllowedExtension check in the media pool component of Redaxo 5.18.2 – 5.21.1. An authenticated backend user who has permission to upload media can upload a specially crafted JPEG/PHP polyglot file named shell.php.any.jpg. When the web server uses a multi‑extension PHP handler, the file is interpreted as PHP and executed with the web‑server user’s privileges. This results in remote code execution on the host. The weakness is identified as CWE‑434.

The affected product is Redaxo core. Versions from 5.18.2 through 5.21.1 inclusive are vulnerable; the issue is fixed in 5.21.1 and later releases.

The CVSS base score of 7.5 indicates a high severity, and the EPSS score of less than 1% shows that exploitation is expected to be rare. The vulnerability is not listed in the CISA KEV catalog. Attack requires an authenticated backend user with the media[upload] permission and a web server configured to treat files with multiple extensions as PHP. Once the attacker uploads the polyglot file, it is executed as the web‑server user, giving the attacker full remote code execution on the affected host.