Threats affecting pkg:github/redaxo/core

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.

REDAXO core versions prior to 5.21.0 contain a reflected cross-site scripting (XSS) vulnerability. Authenticated attackers can exploit this flaw by injecting malicious scripts via the 'type' parameter of the metainfo_default_fields_create API. The vulnerability arises because rex_view::message() renders attacker-controlled input without proper escaping, allowing script execution in the backend session of a victim. This issue is fixed in version 5.21.0.

REDAXO core versions before 5.21.3 have a cross-site request forgery (CSRF) vulnerability in the backend user administration page. The flaw arises because the CSRF token validation only occurs when a specific save parameter is set, but the update action triggered by FUNC_UPDATE bypasses this check. An attacker can exploit this by tricking a logged-in backend user with user management permissions into visiting a crafted link, potentially granting administrator rights, deactivating accounts, or locking out the sole administrator.

REDAXO core versions before 5.21.3 have a reflected cross-site scripting (XSS) vulnerability in the backend media pool detail page. The vulnerability arises because the opener_link parameter is not properly HTML escaped. An unauthenticated attacker can trick logged-in backend users with media permissions into clicking a malicious link, allowing script injection. This script can steal the victim's CSRF token and perform actions with their permissions, including code execution via template or module edits if the victim is an administrator. The issue is fixed in version 5.21.3.

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.

REDAXO core versions from 5.18.0 up to but not including 5.21.4 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the media service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can exploit a race condition or memory exhaustion to upload malicious SVG files that execute scripts in backend user sessions. The vulnerability has a low CVSS 4.0 score of 2.1 and was fixed in version 5.21.4.

REDAXO core versions from 5.3.0 up to but not including 5.21.4 contain an authentication bypass vulnerability in the structure/history plugin. This flaw allows unauthenticated attackers to forge temporary login tokens by forcing the session-tied secret into a predictable state. Exploitation enables attackers to impersonate accounts such as admin, gaining backend access and the ability to execute code outside of live mode. The vulnerability is rated critical with a CVSS 4.0 score of 9.3. A fix is available in version 5.21.4.

REDAXO core versions before 5.21.4 contain a stored cross-site scripting (XSS) vulnerability. This flaw allows content editors to inject malicious HTML via unescaped input in media, medialist, link, and linklist widgets. Exploitation can lead to script execution in administrator backend sessions, potentially hijacking accounts. The vulnerability is fixed in version 5.21.4.

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the content_slice_status and content_move_slice APIs to delete, toggle, move, or overwrite other editors' slices.

REDAXO core versions before 5.21.4 have an authorization bypass vulnerability in the media pool bulk move feature. The flaw allows authenticated backend users with permission on a target media category to move files from restricted source categories without proper authorization checks. This enables silent replacement of media contents site-wide.

REDAXO core versions before 5.21.4 have a missing authorization vulnerability in the structure/version and structure/history frontend preview modes. These modes do not verify category or clang permissions for the previewed article, allowing any backend user or a user with history[article_rollback] permission to access unpublished, historic, or deleted content by manipulating specific parameters.

REDAXO core versions before 5.21.5 have a missing authorization vulnerability in the backup addon export feature. This flaw allows non-admin users with the backup[export] permission to export sensitive database tables, including rex_user and rex_user_session. Exploitation can lead to attackers obtaining plaintext session IDs and stay-logged-in keys, enabling admin account takeover, or access to password hashes for offline cracking. The vulnerability is fixed in version 5.21.5.

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.

REDAXO core versions prior to 5.21.5 have an insufficient session expiration vulnerability. This flaw allows attackers who have obtained a user's session ID or stay-logged-in cookie to maintain backend access even after the user changes their password. The stay-logged-in cookie remains valid for up to three months, enabling persistent unauthorized access.

REDAXO core versions before 5.21.5 have a missing authorization vulnerability in the rex_api_package API function. This flaw allows non-admin backend users with a valid CSRF token to manage packages, including uninstalling system addons, deactivating, installing, activating packages, and deleting non-system packages. The vulnerability can be exploited by attackers holding a valid token, such as demoted admins with active sessions.

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

CVE-2026-62998 is a medium severity vulnerability in the REDAXO PHP-based content management system core. Prior to version 5.21.2, the function rex_list::getSortColumn() improperly accepts a sort request parameter without verifying if the requested column is registered as sortable. This allows an authenticated backend user to cause the system to order query results by unauthorized columns, potentially exposing sensitive information such as user passwords through error-based enumeration. The issue is fixed in REDAXO version 5.21.2.

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVE-2026-63001 is a cross-site scripting (XSS) vulnerability in the REDAXO PHP content management system core. Prior to version 5.21.2, the mediaIsInUse() handler in the media_manager addon inserts unescaped type names into backend warning HTML. An administrator with Media Manager access can inject malicious HTML into a type name, which executes in another administrator's browser during media deletion. This can lead to session theft or unauthorized backend actions. The vulnerability is fixed in REDAXO version 5.21.2.

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.