An Unrestricted File Upload flaw in Redeight CMS 1.0 allows a logged‑in attacker to upload any file through the "/admin/index.php?module=pages&mode=FileAdd" endpoint. The application does not verify file extensions or MIME types, so the attacker can place arbitrary PHP scripts into the publicly accessible "/uploads/files/" directory and execute them directly via the web server, achieving remote code execution.

The vulnerability exists in Redeight CMS version 1.0. No other vendors or product versions are listed as affected.

The flaw has a CVSS score of 8.6, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Because the exploit requires authentication, attackers must first gain access to an administrator account, after which they can upload a malicious script and trigger executable code on the host. Successful exploitation can lead to full system compromise.