GitHub Advisoryadvisory · Packagist

GHSA-xj9j-gjxg-7jvq REDAXO CMS is vulnerable to RCE attack through its template management component

HIGH Published 2025-11-25 Modified 2025-11-26 Official page ↗
Aliases
CVE-2025-64050
Ecosystem
Packagist
Packages
redaxo/source
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2025-11-26

Affected packages

• Packagist redaxo/source: < 5.20.1 → fixed in 5.20.1

Description

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.

Related

Alias · CVE (1)

  • CVE-2025-64050 A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References