[HIGH] Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

PKSA-h751-bdn3-ptsn CVE-2026-53599 GHSA-98pp-vccm-qm25

Affected version: >=5.18.2,<5.21.1

Reported by:
GitHub

[LOW] REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)

PKSA-ps7n-211c-nz3j GHSA-xq4j-g85q-wf97

Affected version: <5.21.0

Reported by:
GitHub

[LOW] REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)

PKSA-4w67-7bxw-yj96 GHSA-m662-8jrj-cw6v

Affected version: <5.21.0

Reported by:
GitHub