An unrestricted file upload vulnerability in the REDAXO CMS core allows authenticated attackers to achieve remote code execution, threatening the integrity and availability of the system.

This is an unrestricted upload of file with a dangerous type (CWE-434). It allows an authenticated user with sufficient privileges to upload malicious files, which can then be executed to compromise the underlying server.

The CVSS score of 7.5 reflects the potential for total system compromise. An attacker who gains the ability to execute arbitrary code can modify system files, install backdoors, or pivot to other systems within the network, leading to severe operational and security consequences.

Immediate Action: Update the REDAXO core to version 5.21.1 or later to implement necessary file validation controls.

Proactive Monitoring: Review server logs for suspicious file uploads or access to newly created files in directories typically used for uploads.

Compensating Controls: Implement strict file type validation at the server level and ensure that upload directories are configured to prevent the execution of scripts.

Public Exploit Available: No (exploit_available: false)

Administrators must prioritize updating to version 5.21.1 to close the file upload vulnerability. Given the potential for remote code execution, ensure that access controls are strictly enforced and that only authorized users have the capability to perform administrative actions within the CMS.