CVE-2026-53691 — Remote Code Execution in Redeight CMS

CVE-2026-53691

Remote Code Execution in Redeight CMS PUBLISHED

Description (CNA)

An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows authenticated attackers to achieve Remote Code Execution via the POST "/admin/index.php?module=pages&mode=FileAdd" endpoint. The application fails to validate file extensions and MIME types, permitting the upload of arbitrary PHP scripts to the publicly accessible "/uploads/files/" directory where they can be executed directly by the web server.

Affected (CNA)

Vendor / product	Versions
Redeight / Redeight CMS	affected 1.0

CWE

CWE-434

References

https://cert.pl/posts/2026/06/CVE-2026-53690

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.