Vulnerability · Published Jun 30, 2026 · Assigned by CERT-PL

CVE-2026-53691Remote Code Execution in Redeight CMS

High 8.6

In plain English

A high-severity unrestricted file upload in Redeight CMS from Redeight. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.7%top 47.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An Unrestricted File Upload vulnerability in Redeight CMS version 1.0 allows authenticated attackers to achieve Remote Code Execution via the POST "/admin/index.php?module=pages&mode=FileAdd" endpoint. The application fails to validate file extensions and MIME types, permitting the upload of arbitrary PHP scripts to the publicly accessible "/uploads/files/" directory where they can be executed directly by the web server.

Affected products (as reported)

Vendor	Product	Versions
Redeight	Redeight CMS	1.0

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L

References

https://cert.pl/posts/2026/06/CVE-2026-53690 third-party-advisory