Vulnerability · Published Nov 25, 2025 · Assigned by mitre
CVE-2025-64050
High 7.2
In plain English
A high-severity code injection in the redaxo/source package (Packagist). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | redaxo/source | 5.20.1 | GHSA-xj9j-gjxg-7jvq |
Affected products (as reported)
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H