A file upload vulnerability exists in REDAXO CMS versions 5.18.2 through 5.21.0 in the rex_mediapool::isAllowedExtension function. Authenticated backend users with media upload permissions can bypass extension validation by uploading a JPEG/PHP polyglot file named with a pattern like shell.php.any.jpg. On web servers configured with multi-extension PHP handlers, such files can be executed as PHP scripts with web-server user privileges. This effectively allows remote code execution by a low-privileged authenticated attacker. The vulnerability resides in redaxo/src/addons/mediapool/lib/mediapool.php. The issue has been patched in REDAXO version 5.21.1. Users are advised to upgrade immediately to mitigate the risk of server compromise.