CVE-2025-64050 | THREATINT

Description

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.

PUBLISHED Reserved 2025-10-27 | Published 2025-11-25 | Updated 2025-11-25 | Assigner mitre

References

github.com/redaxo/redaxo

drive.google.com/...r4wn5zCcBllWmHpxYweCPgcbN0bz?usp=sharing

github.com/...07/CVE-Disclosures/blob/main/CVE-2025-64050.md

cve.org (CVE-2025-64050)

nvd.nist.gov (CVE-2025-64050)

Download JSON