CVE-2025-64050

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-64050
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64050.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-64050
Aliases
Published
2025-11-25T00:00:00Z
Modified
2026-08-22T03:49:52.346375274Z
Severity
  • 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64050.json",
    "cna_assigner": "mitre"
}
References

Affected packages

Git / github.com/redaxo/core

Affected ranges

Type
GIT
Repo
https://github.com/redaxo/core
Events
Introduced
7bc8552a43850597d268eb128732e18aaa949c03
Last affected
7bc8552a43850597d268eb128732e18aaa949c03
Database specific
Show details 
{
    "source": "CPE_STRING",
    "cpe": "cpe:2.3:a:redaxo:redaxo:5.20.0:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "5.20.0"
        },
        {
            "last_affected": "5.20.0"
        }
    ]
}

Affected versions

5.*
5.20.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-64050.json"