REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.

Affected: Packagist: redaxo/source

## Summary `rex_mediapool::isAllowedExtension` in `redaxo/src/addons/mediapool/lib/mediapool.php` accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example `shell.php.any.jpg`. The check only catches the blocked extension when it appears at the end of the filename or immediately before the final extension. An authenticated backend user with mediapool upload permission can upload a JPEG/PHP polyglot named `shell.php.any.jpg` and, on web servers whose PHP handler matches `.php` as any segment (mod_mime `AddHandler`-style, or any `FilesMatch` regex without an end anchor), request the file from the public `media/` directory to execute arbitrary PHP as the web-server user. The vulnerable check is a **regression** introduced in commit [`9d008697d`](https://github.com/redaxo/core/commit/9d008697dcec6bf5a972bdc081fadb68e9dab7fa) (PR #6213, Feb 7 2025), which weakened a previously correct `str_contains` check into a pair of `str_ends_with` checks. The earlier check, in place since 2018 specifically to defend against double-extension attacks, would have blocked this payload. The regression has shipped in every release from 5.18.2 through 5.21.0.

## Details ## Root cause At the audited commit `6e0de42`, `isAllowedExtension` performs three checks against the blocked-extension list: ```php // redaxo/src/addons/mediapool/lib/mediapool.php (104–130) @ 6e0de42 public static function isAllowedExtension(string $filename, a…