CVE-2026-53691 is an Unrestricted File Upload vulnerability (CWE-434) in Redeight CMS version 1.0. Authenticated attackers can exploit the lack of validation on file extensions and MIME types in the file upload functionality at the /admin/index.php?module=pages&mode=FileAdd endpoint. This allows uploading arbitrary PHP scripts to the publicly accessible /uploads/files/ directory, which can then be executed by the web server, resulting in remote code execution.

Successful exploitation allows an authenticated attacker to execute arbitrary code on the server hosting Redeight CMS 1.0. This can lead to full system compromise, data theft, or further attacks within the affected environment. The vulnerability has a high CVSS 4.0 score of 8.6, reflecting its significant impact and ease of exploitation due to lack of required privileges and user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the file upload functionality to trusted users only and consider implementing manual validation or filtering of uploaded files. Monitor for suspicious files in the /uploads/files/ directory and remove any unauthorized scripts. Avoid exposing the upload directory to direct web access if possible.