# CVE-2026-53691: Redeight CMS unrestricted file upload in FileAdd endpoint

Source: https://junglewise.ai/threats/cve-2026-53691-redeight-cms-unrestricted-file-upload-in-fileadd-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-30. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-53691 · Severity: info · CVSS 8.6 · Published 2026-06-30

Redeight CMS, a content management system, contains a security flaw that allows users with login access to upload malicious files. By uploading a specially crafted script, an attacker can take full control of the web server. This could lead to the theft of sensitive data, website defacement, or a total service outage.

Technologies: [Redeight CMS](https://junglewise.ai/threats/technologies/redeight-cms). Vendors: [Redeight](https://junglewise.ai/threats/vendors/redeight).

## Quick answers

**Is CVE-2026-53691 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-53691 being exploited in the wild.

**How severe is CVE-2026-53691?** Informational severity, with a CVSS score of 8.6, published 30 June 2026.

**Which products and versions are affected?** Redeight CMS 1.0.

**Is there a fix for CVE-2026-53691?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-53691 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-53691?** Check whether you run Redeight CMS at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An unrestricted file upload vulnerability exists in Redeight CMS 1.0 within the '/admin/index.php?module=pages&mode=FileAdd' endpoint. The application fails to validate file extensions or MIME types for uploaded files. An authenticated attacker can exploit this by uploading a malicious PHP script to the '/uploads/files/' directory, which is publicly accessible. Because the web server executes scripts in this directory, the attacker can achieve Remote Code Execution (RCE) on the underlying host.

## Affected products

- Redeight Redeight CMS 1.0

## Timeline

- 2026-06-30: disclosed: Vulnerability disclosed by CERT.PL
- 2026-06-30: advisory

## References

- [https://cert.pl/posts/2026/06/CVE-2026-53690](https://cert.pl/posts/2026/06/CVE-2026-53690)

## Related threats

- [Redeight CMS weak password encoding using unsalted MD5](https://junglewise.ai/threats/cve-2026-53692-redeight-cms-weak-password-encoding-using-unsalted-md5)
- [Redeight CMS SQL injection in admin login endpoint](https://junglewise.ai/threats/cve-2026-53690-redeight-cms-sql-injection-in-admin-login-endpoint)