EIP-2026-111728

The exploit describes a file upload vulnerability in Redaxo CMS Mediapool Addon < 5.5.1, where a blacklist bypass allows arbitrary file uploads by using filenames like 'php71' or 'php53'. The vulnerability was fixed in mediapool 2.4.0 and Redaxo CMS 5.6.0.