Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
15 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable(). Although the value is wrapped in backticks via escapeIdentifier() (preventing classical SQL injection), this still allows any authenticated backend user to ORDER BY any column in the query's FROM tables, including unselected sensitive columns such as password from the rexuser table, and perform error-based column enumeration. Details File: redaxo/src/core/lib/list.php:976-982 — getSortColumn() returns the raw request parameter without whitelist check: File: redaxo/src/core/lib/list.php:899-911 — prepareQuery() uses it directly in the ORDER BY clause: The users list queries rexuser which contains password, previouspasswords, passwordchangerequired — not in the SELECT. Specifying a non-existent column name produces a MySQL Unknown column exception whose message is propagated to the user, confirming or…
Recommended action: Upgrade to 5.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The rexapiinstallpackageupdate API function (install addon) does not override requiresCsrfProtection(), which defaults to false in the base class rexapifunction. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server. Details File: redaxo/src/core/lib/apifunction.php:277-280 File: redaxo/src/addons/install/lib/api/apipackageupdate.php:8-39 For comparison, rexapiinstallpackageadd and rexapiinstallpackagedelete both correctly return true. Only rexapiinstallpackageupdate is missing this. PoC When an authenticated admin visits this page, the request is automatically made with their session cookie, causing someaddon to be updated to version fileid=42. Impact An attacker who can lure an admin to a malicious page can force-install specific addon versions. If combined with a supply-chain compromise of a package on redaxo.org, or by targeting a downgrade to a known-vulnerable version, this becomes a…
Recommended action: Upgrade to 5.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The mediapool sync page (sync.php) renders filenames from the /media filesystem directory directly into HTML without applying rexescape() (i.e., htmlspecialchars). Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any backend user who views the sync page. Details In redaxo/src/addons/mediapool/pages/sync.php, the variable $diffFiles is populated from actual filesystem filenames (files in /media/ not yet registered in the database). These filenames are then rendered without escaping: File: redaxo/src/addons/mediapool/pages/sync.php:119-120 File: redaxo/src/addons/mediapool/pages/sync.php:170 By contrast, all other filename displays in the codebase use rexescape($fname) (e.g., media.detail.php:236, media.list.php). The sync page is accessible to any backend user with the media[sync] permission (not exclusively admins). PoC 1. Place a file named <img src=x onerror=alert(document.cookie).txt into the…
Recommended action: Upgrade to 5.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's name field without HTML escaping. An attacker with access to the Media Manager addon can store an XSS payload as a type name; the payload executes in the browser of any administrator who subsequently tries to delete a media file linked to that type's effects. This can lead to session hijacking and full backend account takeover. --- Details File: redaxo/src/addons/mediamanager/lib/mediamanager.php Function: mediaIsInUse() — registered on the MEDIAISINUSE extension point in boot.php When rexmediaservice::deleteMedia() is called, it invokes rexmediapool::mediaIsInUse($filename), which fires the MEDIAISINUSE extension point. The mediamanager addon's handler queries all effects whose parameters JSON contains the filename, then constructs an HTML…
Recommended action: Upgrade to 5.21.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
rexmediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php accepts filenames that contain a blocked extension as a non-terminal segment of a longer extension chain, for example shell.php.any.jpg. The check only catches the blocked extension when it appears at the end of the filename or immediately before the final extension. An authenticated backend user with mediapool upload permission can upload a JPEG/PHP polyglot named shell.php.any.jpg and, on web servers whose PHP handler matches .php as any segment (modmime AddHandler-style, or any FilesMatch regex without an end anchor), request the file from the public media/ directory to execute arbitrary PHP as the web-server user. The vulnerable check is a regression introduced in commit 9d008697d (PR #6213, Feb 7 2025), which weakened a previously correct strcontains check into a pair of strendswith checks. The earlier check, in place since 2018 specifically to defend against double-extension attacks, would…
Recommended action: Upgrade to 5.21.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected XSS vulnerability has been identified in the REDAXO backend. The `function` parameter is concatenated into an API error message and rendered without HTML escaping. --- Details Root cause User input `function` is injected into an exception message, then rendered by `rex_view::error()` which delegates to `rex_view::message()` without HTML escaping. Vulnerable code (`redaxo/src/core/lib/packages/api_package.php`) : ```php $function = rex_request('function', 'string'); throw new rex_api_exception('Unknown package function "' . $function . '"!'); ``` Sink (`redaxo/src/core/lib/view.php`) : ```php return ' ' . $message . ' '; ``` Source -> sink flow * Source: `function` (GET) * Propagation: concatenated into the exception message * Sink: rendered via `rex_view::error()` -> `rex_view::message()` without escaping Authentication required: yes (backend session) --- PoC - Exploit ```python #!/usr/bin/env python3 import re import…
Recommended action: Upgrade to 5.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected XSS vulnerability has been identified in the REDAXO backend. The `type` parameter is concatenated into an API error message and rendered without HTML escaping. --- Details Root cause User input `type` is injected into an exception message, then rendered by `rex_view::error()` which delegates to `rex_view::message()` without HTML escaping. Vulnerable code (`redaxo/src/addons/metainfo/lib/handler/api_default_fields.php`) : ```php $type = rex_get('type', 'string'); throw new rex_api_exception(sprintf('metainfo type "%s" does not have default field.', $type)); ``` Sink (`redaxo/src/core/lib/view.php`) : ```php return ' ' . $message . ' '; ``` Data flow source -> sink - Source : `type` (GET) - Propagation : concatenated into the exception message - Sink : rendered via `rex_view::error()` -> `rex_view::message()` without escaping Authentication required : yes (backend session) --- PoC - exploit ```python #!/usr/bin/env python3 import…
Recommended action: Upgrade to 5.21.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. <img width="664" height="899" alt="image" src="https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5" / <img width="2358" height="445" alt="image" src="https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb" / Details The Backup addon does not validate the EXPDIR POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing ../ sequences (or even absolute paths inside the document root) to include any readable file in the generated .tar.gz archive. Vulnerable code: - redaxo/src/addons/backup/pages/export.php (lines 72-76) – directly uses $POST['EXPDIR'] - redaxo/src/addons/backup/lib/backup.php (lines ~413 & ~427) – concatenates unsanitized user input with base path This allows disclosure of sensitive files…
Recommended action: Upgrade to 5.20.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in. Details Control Flow: 1. redaxo/src/addons/mediapool/pages/index.php reads args via rexrequest('args', 'array') and passes them through as $argUrl to media.list.php. 2. redaxo/src/addons/mediapool/pages/media.list.php injects $argUrl['args']['types'] into an HTML string without escaping: PoC 1. Log into the REDAXO backend. 2. While authenticated, open a crafted URL like: <host/index.php?page=mediapool/media&args[types]="<img+src%3Dx+onerror%3Dalert%28document.domain%29 4. The info banner displays the unescaped value and activates the injected onerror handler, which opens an alert pop-up. Impact Arbitrary JavaScript execution in the backend, enabling theft of session…
Recommended action: Upgrade to 5.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is executed when visitors access frontend pages using the compromised template.
Recommended action: Upgrade to 5.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject arbitrary web script or HTML via the Output code field in modules. The payload is executed when a user views or edits an article by adding slice that uses the compromised module.
Recommended action: Upgrade to 5.20.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Reflected cross-site scripting (XSS) is a type of web vulnerability that occurs when a web application fails to properly sanitize user input, allowing an attacker to inject malicious code into the application's response to a user's request. When the user's browser receives the response, the malicious code is executed, potentially allowing the attacker to steal sensitive information or take control of the user's account. Details On the latest version of Redaxo, v5.18.2, the rex-api-result parameter is vulnerable to Reflected cross-site scripting (XSS) on the page of AddOns. PoC 1. Login Redaxo as administrative user. 2. Navigate to the URL: http://localhost/redaxo/index.php?page=packages&rex-api-call=package&&rex-api-result={%22succeeded%22%3Atrue%2C%22message%22%3A%22%3Cimg%20src=x%20onerror=alert(document.domain);%3E%22};%3E%22%7D), the XSS executes. Impact This can lead to various security risks, including session hijacking, phishing attacks and malware distribution.…
Recommended action: Upgrade to 5.18.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An arbitrary file upload vulnerability was identified in the redaxo. This flaw permits users to upload malicious files, which can lead to JavaScript code execution and distribute malware. Details On the latest version of Redaxo, v5.18.2, the mediapool/media page is vulnerable to arbitrary file upload. PoC 1. Log in to the portal then navigate to Mediapool. 2. Upload a png file (ex: poc.png) 3. Intercept the upload HTTP request on burp suite and change filename: poc.1html, Content-Type:image/html and insert the malicious html code. (ex: <IFRAME SRC="javascript:alert(1);"</IFRAME) 4. Forward the request. 5. Navigate to the file. Impact Exploiting an arbitrary file upload vulnerability enables attackers to execute malicious code on a server.
Recommended action: Upgrade to 5.18.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Stored XSS in REDAXO 5.18.1 - Article / "content/edit". Details On the latest version of Redaxo, v5.18.1, the article name field is susceptible to stored XSS. Impact A malicious actor can easily steal cookie using this stored XSS and perform a session hijacking attack.
Recommended action: Upgrade to 5.18.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote attacker to escalate privileges.
Recommended action: Upgrade to 5.18.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.