CVE-2026-63001 (GCVE-0-2026-63001)
Vulnerability from cvelistv5 – Published: 2026-09-23 14:03 – Updated: 2026-09-23 19:45
VLAI
EPSS
VEX
Title
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Summary
REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
Severity
4.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-23 18:17 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
4 references
| URL | Tags |
|---|---|
| https://github.com/redaxo/core/security/advisorie… | x_refsource_CONFIRM |
| https://github.com/redaxo/core/pull/6581 | x_refsource_MISC |
| https://github.com/redaxo/core/commit/2daaa3a3057… | x_refsource_MISC |
| https://github.com/redaxo/core/releases/tag/5.21.2 | x_refsource_MISC |
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:17:12.653764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T19:45:21.599Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "redaxo",
"versions": [
{
"status": "affected",
"version": "\u003c 5.21.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator\u0027s browser when that administrator tries to delete media referenced by the type\u0027s effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:03:12.137Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq"
},
{
"name": "https://github.com/redaxo/core/pull/6581",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/pull/6581"
},
{
"name": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
},
{
"name": "https://github.com/redaxo/core/releases/tag/5.21.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/releases/tag/5.21.2"
}
],
"source": {
"advisory": "GHSA-mf2p-wjp4-99pq",
"discovery": "UNKNOWN"
},
"title": "REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63001",
"datePublished": "2026-09-23T14:03:12.137Z",
"dateReserved": "2026-07-14T23:10:57.032Z",
"dateUpdated": "2026-09-23T19:45:21.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-63001",
"date": "2026-10-29",
"epss": "0.00197",
"percentile": "0.09458"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"product": "core",
"vendor": "redaxo",
"versions": [
{
"status": "affected",
"version": "\u003c 5.21.2"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E",
"versionEndExcluding": "5.21.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator\u0027s browser when that administrator tries to delete media referenced by the type\u0027s effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
}
],
"id": "CVE-2026-63001",
"lastModified": "2026-10-19T20:35:19.627",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-63001",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:17:12.653764Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-23T15:17:15.617",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/redaxo/core/pull/6581"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/redaxo/core/releases/tag/5.21.2"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-63001",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:17:12.653764Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T18:17:18.874Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "core",
"vendor": "redaxo",
"versions": [
{
"status": "affected",
"version": "\u003c 5.21.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator\u0027s browser when that administrator tries to delete media referenced by the type\u0027s effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-23T14:03:12.137Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq"
},
{
"name": "https://github.com/redaxo/core/pull/6581",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/pull/6581"
},
{
"name": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
},
{
"name": "https://github.com/redaxo/core/releases/tag/5.21.2",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/redaxo/core/releases/tag/5.21.2"
}
],
"source": {
"advisory": "GHSA-mf2p-wjp4-99pq",
"discovery": "UNKNOWN"
},
"title": "REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-63001",
"datePublished": "2026-09-23T14:03:12.137Z",
"dateReserved": "2026-07-14T23:10:57.032Z",
"dateUpdated": "2026-09-23T19:45:21.599Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
FKIE_CVE-2026-63001
Vulnerability from fkie_nvd - Published: 2026-09-23 15:17 - Updated: 2026-10-19 20:35
Severity
Summary
REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
References
{
"affected": [
{
"affectedData": [
{
"product": "core",
"vendor": "redaxo",
"versions": [
{
"status": "affected",
"version": "\u003c 5.21.2"
}
]
}
],
"source": "security-advisories@github.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*",
"matchCriteriaId": "AE32E7EC-4A5F-4137-B203-C60BFCFD8B6E",
"versionEndExcluding": "5.21.2",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator\u0027s browser when that administrator tries to delete media referenced by the type\u0027s effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
}
],
"id": "CVE-2026-63001",
"lastModified": "2026-10-19T20:35:19.627",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "HIGH",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.7,
"impactScore": 2.7,
"source": "security-advisories@github.com",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-63001",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-23T18:17:12.653764Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-09-23T15:17:15.617",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Patch"
],
"url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
},
{
"source": "security-advisories@github.com",
"tags": [
"Issue Tracking",
"Patch"
],
"url": "https://github.com/redaxo/core/pull/6581"
},
{
"source": "security-advisories@github.com",
"tags": [
"Release Notes"
],
"url": "https://github.com/redaxo/core/releases/tag/5.21.2"
},
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Vendor Advisory"
],
"url": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
}
]
}
GHSA-MF2P-WJP4-99PQ
Vulnerability from github – Published: 2026-09-23 14:04 – Updated: 2026-09-23 14:04
VLAI
Summary
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Details
Summary
A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's name field without HTML escaping. An attacker with access to the Media Manager addon can store an XSS payload as a type name; the payload executes in the browser of any administrator who subsequently tries to delete a media file linked to that type's effects. This can lead to session hijacking and full backend account takeover.
Details
File: redaxo/src/addons/media_manager/lib/media_manager.php
Function: mediaIsInUse() — registered on the MEDIA_IS_IN_USE extension point in boot.php
When rex_media_service::deleteMedia() is called, it invokes rex_mediapool::mediaIsInUse($filename), which fires the MEDIA_IS_IN_USE extension point. The media_manager addon's handler queries all effects whose parameters JSON contains the filename, then constructs an HTML anchor with the type name inserted verbatim:
// media_manager.php ~line 457 ← VULNERABLE
$message = '<a href="javascript:openPage(\'' . rex_url::backendPage(...) . '\')">'
. rex_i18n::msg('media_manager') . ' '
. rex_i18n::msg('media_manager_effect_name') . ': '
. (string) $sql->getValue('name') // ← NO rex_escape() call
. '</a>';
The returned $message string is concatenated into the exception message thrown by deleteMedia() and rendered by rex_view::error() as raw HTML.
Contrast with the correct pattern used elsewhere in the same addon:
// types.php line 91 ← CORRECT
$name = '<b>' . rex_escape($list->getValue('name')) . '</b>';
Input validation gap: types.php line 200 validates the type name with the rule NOT_MATCH '{[/\\]}', which blocks {, /, and \ but permits <, >, ", ', and & — all characters required to inject HTML.
PoC
Test environment: REDAXO 5.x running at http://localhost/
Account required: Any REDAXO backend administrator
Test credentials: username admin / password Admin12345!
Step 1 — Seed test data directly into the database (single CMD command)
docker exec -i 34--core-5x-redaxo-1 php -r "$p=new PDO('mysql:host=db;dbname=redaxo','redaxo','redaxo');$p->exec(\"INSERT IGNORE INTO rex_media(category_id,attributes,filetype,filename,originalname,filesize,width,height,title,createdate,createuser,updatedate,updateuser) VALUES(0,'','image/jpeg','xss_test.jpg','xss_test.jpg',284,1,1,'XSS Test',NOW(),'admin',NOW(),'admin')\");$tid=$p->query(\"SELECT id FROM rex_media_manager_type WHERE name='<img src=x onerror=alert(document.domain)>'\")->fetchColumn();if(!$tid){$p->prepare(\"INSERT INTO rex_media_manager_type(status,name,description,createdate,createuser,updatedate,updateuser) VALUES(1,?,'poc',NOW(),'admin',NOW(),'admin')\")->execute(['<img src=x onerror=alert(document.domain)>']);$tid=$p->lastInsertId();}$p->prepare(\"INSERT IGNORE INTO rex_media_manager_type_effect(type_id,effect,parameters,priority,createdate,createuser,updatedate,updateuser) VALUES(?,'watermark',?,1,NOW(),'admin',NOW(),'admin')\")->execute([$tid,json_encode(['rex_effect_watermark'=>['watermark_image'=>'xss_test.jpg']])]);echo \"OK type_id=$tid\n\";"
Step 2 — Place a 1×1 JPEG in the media directory
docker exec 34--core-5x-redaxo-1 sh -c "printf '\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xff\xdb\x00C\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07\x07\t\t\x08\n\x0c\x14\r\x0c\x0b\x0b\x0c\x19\x12\x13\x0f\x14\x1d\x1a\x1f\x1e\x1d\x1a\x1c\x1c $.\' \",#\x1c\x1c(7),01444\x1f\x27=82<.342\x1e>\x1b\x1b123\x1e4\x1c\x1f\xff\xc0\x00\x0b\x08\x00\x01\x00\x01\x01\x01\x11\x00\xff\xc4\x00\x1f\x00\x00\x01\x05\x01\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\xff\xda\x00\x08\x01\x01\x00\x00?\x00\xf5\x00\xff\xd9' > /var/www/html/media/xss_test.jpg"
Step 3 — Login to the backend
Open a browser and navigate to:
http://localhost/redaxo/index.php
Login with: admin / Admin12345!
Step 4 — Trigger the XSS
Navigate to the media file detail page:
http://localhost/redaxo/index.php?page=mediapool/media&file_id=1
Click the Delete button. REDAXO checks whether the file is in use, finds the Watermark effect whose parameters JSON references xss_test.jpg, and renders the type name in the warning HTML without escaping.
Result: The browser executes <img src=x onerror=alert(document.domain)> and an alert dialog showing the current domain appears immediately.
Impact
Vulnerability type: Stored Cross-Site Scripting (Stored XSS)
Who is impacted: Any backend administrator who attempts to delete a media file that is referenced by a Media Manager effect. A malicious administrator (or an attacker who has compromised any admin account) can pre-plant a payload in a type name. All other administrators who later try to delete affected media files will have the payload executed in their browser sessions.
Exploitability: - Privilege required to plant: Administrator (access to Media Manager addon) - Privilege required to trigger: Administrator (access to Mediapool) - User interaction required: Victim must click "Delete" on a media file
Realistic attack scenarios:
- Session cookie theft via document.cookie exfiltration (leads to full account takeover)
- Credential harvesting by dynamically replacing the login form
- CSRF-token extraction to perform authenticated actions on behalf of the victim
Fix
Apply rex_escape() to the type name before concatenating it into the HTML anchor:
// media_manager.php — apply rex_escape() to the name value
$message = '<a href="javascript:openPage(\'' . rex_url::backendPage(...) . '\')">'
. rex_i18n::msg('media_manager') . ' '
. rex_i18n::msg('media_manager_effect_name') . ': '
. rex_escape((string) $sql->getValue('name')) // ← ADD rex_escape()
. '</a>';
Severity
4.8 (Medium)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 5.21.1"
},
"package": {
"ecosystem": "Packagist",
"name": "redaxo/source"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.21.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-63001"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-23T14:04:40Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "### Summary\n\nA stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type\u0027s `name` field without HTML escaping. An attacker with access to the Media Manager addon can store an XSS payload as a type name; the payload executes in the browser of any administrator who subsequently tries to delete a media file linked to that type\u0027s effects. This can lead to session hijacking and full backend account takeover.\n\n---\n\n### Details\n\n**File:** `redaxo/src/addons/media_manager/lib/media_manager.php`\n**Function:** `mediaIsInUse()` \u2014 registered on the `MEDIA_IS_IN_USE` extension point in `boot.php`\n\nWhen `rex_media_service::deleteMedia()` is called, it invokes `rex_mediapool::mediaIsInUse($filename)`, which fires the `MEDIA_IS_IN_USE` extension point. The media_manager addon\u0027s handler queries all effects whose `parameters` JSON contains the filename, then constructs an HTML anchor with the type name inserted verbatim:\n\n```php\n// media_manager.php ~line 457 \u2190 VULNERABLE\n$message = \u0027\u003ca href=\"javascript:openPage(\\\u0027\u0027 . rex_url::backendPage(...) . \u0027\\\u0027)\"\u003e\u0027\n . rex_i18n::msg(\u0027media_manager\u0027) . \u0027 \u0027\n . rex_i18n::msg(\u0027media_manager_effect_name\u0027) . \u0027: \u0027\n . (string) $sql-\u003egetValue(\u0027name\u0027) // \u2190 NO rex_escape() call\n . \u0027\u003c/a\u003e\u0027;\n```\n\nThe returned `$message` string is concatenated into the exception message thrown by `deleteMedia()` and rendered by `rex_view::error()` as raw HTML.\n\n**Contrast with the correct pattern used elsewhere in the same addon:**\n\n```php\n// types.php line 91 \u2190 CORRECT\n$name = \u0027\u003cb\u003e\u0027 . rex_escape($list-\u003egetValue(\u0027name\u0027)) . \u0027\u003c/b\u003e\u0027;\n```\n\n**Input validation gap:** `types.php` line 200 validates the type name with the rule `NOT_MATCH \u0027{[/\\\\]}\u0027`, which blocks `{`, `/`, and `\\` but permits `\u003c`, `\u003e`, `\"`, `\u0027`, and `\u0026` \u2014 all characters required to inject HTML.\n\n---\n\n### PoC\n\n\n\u003cimg width=\"2074\" height=\"1720\" alt=\"image\" src=\"https://github.com/user-attachments/assets/207f85d3-f4e2-4828-9211-8da36ec9c43d\" /\u003e\n\n\n**Test environment:** REDAXO 5.x running at `http://localhost/`\n**Account required:** Any REDAXO backend administrator\n**Test credentials:** username `admin` / password `Admin12345!`\n\n#### Step 1 \u2014 Seed test data directly into the database (single CMD command)\n\n```cmd\ndocker exec -i 34--core-5x-redaxo-1 php -r \"$p=new PDO(\u0027mysql:host=db;dbname=redaxo\u0027,\u0027redaxo\u0027,\u0027redaxo\u0027);$p-\u003eexec(\\\"INSERT IGNORE INTO rex_media(category_id,attributes,filetype,filename,originalname,filesize,width,height,title,createdate,createuser,updatedate,updateuser) VALUES(0,\u0027\u0027,\u0027image/jpeg\u0027,\u0027xss_test.jpg\u0027,\u0027xss_test.jpg\u0027,284,1,1,\u0027XSS Test\u0027,NOW(),\u0027admin\u0027,NOW(),\u0027admin\u0027)\\\");$tid=$p-\u003equery(\\\"SELECT id FROM rex_media_manager_type WHERE name=\u0027\u003cimg src=x onerror=alert(document.domain)\u003e\u0027\\\")-\u003efetchColumn();if(!$tid){$p-\u003eprepare(\\\"INSERT INTO rex_media_manager_type(status,name,description,createdate,createuser,updatedate,updateuser) VALUES(1,?,\u0027poc\u0027,NOW(),\u0027admin\u0027,NOW(),\u0027admin\u0027)\\\")-\u003eexecute([\u0027\u003cimg src=x onerror=alert(document.domain)\u003e\u0027]);$tid=$p-\u003elastInsertId();}$p-\u003eprepare(\\\"INSERT IGNORE INTO rex_media_manager_type_effect(type_id,effect,parameters,priority,createdate,createuser,updatedate,updateuser) VALUES(?,\u0027watermark\u0027,?,1,NOW(),\u0027admin\u0027,NOW(),\u0027admin\u0027)\\\")-\u003eexecute([$tid,json_encode([\u0027rex_effect_watermark\u0027=\u003e[\u0027watermark_image\u0027=\u003e\u0027xss_test.jpg\u0027]])]);echo \\\"OK type_id=$tid\\n\\\";\"\n```\n\n#### Step 2 \u2014 Place a 1\u00d71 JPEG in the media directory\n\n```cmd\ndocker exec 34--core-5x-redaxo-1 sh -c \"printf \u0027\\xff\\xd8\\xff\\xe0\\x00\\x10JFIF\\x00\\x01\\x01\\x00\\x00\\x01\\x00\\x01\\x00\\x00\\xff\\xdb\\x00C\\x00\\x08\\x06\\x06\\x07\\x06\\x05\\x08\\x07\\x07\\x07\\t\\t\\x08\\n\\x0c\\x14\\r\\x0c\\x0b\\x0b\\x0c\\x19\\x12\\x13\\x0f\\x14\\x1d\\x1a\\x1f\\x1e\\x1d\\x1a\\x1c\\x1c $.\\\u0027 \\\",#\\x1c\\x1c(7),01444\\x1f\\x27=82\u003c.342\\x1e\u003e\\x1b\\x1b123\\x1e4\\x1c\\x1f\\xff\\xc0\\x00\\x0b\\x08\\x00\\x01\\x00\\x01\\x01\\x01\\x11\\x00\\xff\\xc4\\x00\\x1f\\x00\\x00\\x01\\x05\\x01\\x01\\x01\\x01\\x01\\x01\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x00\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\t\\n\\x0b\\xff\\xda\\x00\\x08\\x01\\x01\\x00\\x00?\\x00\\xf5\\x00\\xff\\xd9\u0027 \u003e /var/www/html/media/xss_test.jpg\"\n```\n\n#### Step 3 \u2014 Login to the backend\n\nOpen a browser and navigate to:\n\n```\nhttp://localhost/redaxo/index.php\n```\n\nLogin with: **admin** / **Admin12345!**\n\n#### Step 4 \u2014 Trigger the XSS\n\nNavigate to the media file detail page:\n\n```\nhttp://localhost/redaxo/index.php?page=mediapool/media\u0026file_id=1\n```\n\nClick the **Delete** button. REDAXO checks whether the file is in use, finds the Watermark effect whose `parameters` JSON references `xss_test.jpg`, and renders the type name in the warning HTML without escaping.\n\n**Result:** The browser executes `\u003cimg src=x onerror=alert(document.domain)\u003e` and an alert dialog showing the current domain appears immediately.\n\n---\n\n### Impact\n\n**Vulnerability type:** Stored Cross-Site Scripting (Stored XSS)\n\n**Who is impacted:**\nAny backend administrator who attempts to delete a media file that is referenced by a Media Manager effect. A malicious administrator (or an attacker who has compromised any admin account) can pre-plant a payload in a type name. All other administrators who later try to delete affected media files will have the payload executed in their browser sessions.\n\n**Exploitability:**\n- Privilege required to plant: Administrator (access to Media Manager addon)\n- Privilege required to trigger: Administrator (access to Mediapool)\n- User interaction required: Victim must click \"Delete\" on a media file\n\n**Realistic attack scenarios:**\n- Session cookie theft via `document.cookie` exfiltration (leads to full account takeover)\n- Credential harvesting by dynamically replacing the login form\n- CSRF-token extraction to perform authenticated actions on behalf of the victim\n\n---\n\n### Fix\n\nApply `rex_escape()` to the type name before concatenating it into the HTML anchor:\n\n```php\n// media_manager.php \u2014 apply rex_escape() to the name value\n$message = \u0027\u003ca href=\"javascript:openPage(\\\u0027\u0027 . rex_url::backendPage(...) . \u0027\\\u0027)\"\u003e\u0027\n . rex_i18n::msg(\u0027media_manager\u0027) . \u0027 \u0027\n . rex_i18n::msg(\u0027media_manager_effect_name\u0027) . \u0027: \u0027\n . rex_escape((string) $sql-\u003egetValue(\u0027name\u0027)) // \u2190 ADD rex_escape()\n . \u0027\u003c/a\u003e\u0027;\n```",
"id": "GHSA-mf2p-wjp4-99pq",
"modified": "2026-09-23T14:04:40Z",
"published": "2026-09-23T14:04:40Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq"
},
{
"type": "WEB",
"url": "https://github.com/redaxo/core/pull/6581"
},
{
"type": "WEB",
"url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
},
{
"type": "PACKAGE",
"url": "https://github.com/redaxo/core"
},
{
"type": "WEB",
"url": "https://github.com/redaxo/core/releases/tag/5.21.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`"
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.