p PatchFirst

CVE-2026-63001

CVE-2026-63001 · REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

This page contains facts from public vulnerability sources. Check the original advisory before updating.

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVSS 4.8 · Medium · EPSS 0.2% · Public exploit · Fix available

Published
Updated

Stack: php

Affected products and versions

  • core

    Versions
    • < 5.21.2: Affected

    No fix published

  • redaxo/source Packagist

    Versions
    • 5.10.0
    • 5.10.0-beta1
    • 5.10.0-beta2
    • 5.10.1
    • 5.11.0
    • 5.11.0-beta1
    • 5.11.1
    • 5.11.2
    • 5.12.0
    • 5.12.0-beta1
    • 5.12.0-beta2
    • 5.12.0-beta3
    • 5.12.1
    • 5.13.0
    • 5.13.0-beta1
    • 5.13.0-beta2
    • 5.13.1
    • 5.13.2
    • 5.13.3
    • 5.14.0
    • 5.14.0-beta1
    • 5.14.0-beta2
    • 5.14.1
    • 5.14.2
    • 5.14.3
    • 5.15.0
    • 5.15.0-beta1
    • 5.15.1
    • 5.16.0
    • 5.16.0-beta1
    • 5.16.1
    • 5.17.0
    • 5.17.1
    • 5.18.0
    • 5.18.1
    • 5.18.2
    • 5.18.3
    • 5.19.0
    • 5.20.0
    • 5.20.1
    • 5.20.2
    • 5.21.0
    • 5.21.0-beta1
    • 5.21.1
    Affected ranges
    • ECOSYSTEM: < 5.21.2

    Update to 5.21.2

Original sources

Check your server →