Unrestricted File Upload Vulnerability in Redeight CMS by Redeight
CVE-2026-53691

8.6HIGH

Key Information:

Vendor

Redeight

Status
Redeight Cms
Vendor
CVE Published:
30 June 2026

What is CVE-2026-53691?

The Redeight CMS version 1.0 is vulnerable to an unrestricted file upload issue, allowing authenticated attackers to exploit the system via the POST request to the /admin/index.php?module=pages&mode=FileAdd endpoint. Due to inadequate file validation mechanisms for extensions and MIME types, attackers can upload malicious PHP scripts to the publicly accessible /uploads/files/ directory, enabling remote code execution by the web server. This poses a significant risk to the integrity and security of the system and its data.

Affected Version(s)

Redeight CMS 1.0

References

https://cert.pl/posts/2026/06/CVE-2026-53690
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jacek Czepil
.