CVE-2025-64050
High · 7.2REDAXO CMS is vulnerable to RCE attack through its template management component
CVSS
7.2
EPSS
0.9%
Published
Nov 25, 2025
CISA due date
—
The record
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | redaxo/source | 0 | 5.20.1 |
Related vulnerabilities
- GHSA-xj9j-gjxg-7jvq REDAXO CMS is vulnerable to RCE attack through its template management component Same vulnerability
- GHSA-824x-88xg-cwrv Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Also affects redaxo/source
- CVE-2026-21857 Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Also affects redaxo/source
- GHSA-x6vr-q3vf-vqgq REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] Also affects redaxo/source
- GHSA-vqc7-7fj4-3fm3 REDAXO CMS is vulnerable to XSS through its module management component Also affects redaxo/source
- CVE-2025-64049 REDAXO CMS is vulnerable to XSS through its module management component Also affects redaxo/source
- CVE-2025-66026 REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] Also affects redaxo/source
- CVE-2026-114125 Storybook is a frontend workshop for building user interface components and pages in… CWE-94