Threat database

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

CVE-2026-62998 is a medium severity vulnerability in the REDAXO PHP-based content management system core. Prior to version 5.21.2, the function rex_list::getSortColumn() improperly accepts a sort request parameter without verifying if the requested column is registered as sortable. This allows an authenticated backend user to cause the system to order query results by unauthorized columns, potentially exposing sensitive information such as user passwords through error-based enumeration. The issue is fixed in REDAXO version 5.21.2.

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVE-2026-63001 is a cross-site scripting (XSS) vulnerability in the REDAXO PHP content management system core. Prior to version 5.21.2, the mediaIsInUse() handler in the media_manager addon inserts unescaped type names into backend warning HTML. An administrator with Media Manager access can inject malicious HTML into a type name, which executes in another administrator's browser during media deletion. This can lead to session theft or unauthorized backend actions. The vulnerability is fixed in REDAXO version 5.21.2.

REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shell.php.any.jpg, which web servers with multi-extension PHP handlers can execute as the web-server user. This issue is fixed in version 5.21.1.