CVE-2026-63001 in REDAXO
Summary
by MITRE • 09/23/2026
REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified involves a Cross-Site Scripting flaw within REDAXO, specifically affecting versions prior to 5.21.2. As a PHP-based content management system, REDAXO relies on various backend handlers to manage media assets and their associated metadata. The specific point of failure lies in the mediaIsInUse() handler located in redaxo/src/addons/media_manager/lib/media_manager.php. This function is responsible for determining whether a particular media file is currently referenced by any active configurations or effects within the Media Manager addon. When this check is triggered via the MEDIA_IS_IN_USE operation, the system retrieves the name of the Media Manager type associated with the media and incorporates it directly into an HTML warning message intended for display in the administrative interface.
The core technical flaw stems from a lack of proper output encoding or escaping when inserting the Media Manager type name into the raw backend warning HTML structure. In secure web application development, any data derived from user input or stored database values that is rendered within an HTML context must be sanitized to prevent interpretation as executable code. By failing to escape special characters such as angle brackets and quotes in the type name field, the application allows for the injection of arbitrary JavaScript payloads. This represents a classic Stored Cross-Site Scripting vulnerability where malicious content persists on the server side until it is retrieved and rendered by another user's browser.
The operational impact of this flaw is significant due to its potential for session hijacking and unauthorized administrative actions. An attacker with access to create or modify Media Manager types can store HTML containing JavaScript code within a type name field. When an administrator, who possesses the necessary permissions to manage media files, attempts to delete a media item that is referenced by the effects of this maliciously configured type, the system triggers the vulnerable handler. The browser then executes the injected script in the context of the administrator's active session. This execution environment grants the attacker access to sensitive cookies, including authentication tokens and session identifiers, which can be exfiltrated to a remote server controlled by the adversary.
Beyond simple data theft, this vulnerability enables broader compromise scenarios aligned with common attack patterns found in industry frameworks such as MITRE ATT&CK. The exploitation of stored XSS for credential harvesting maps directly to techniques involving collection of browser-based credentials and session cookie stealing. Furthermore, if the injected script performs actions on behalf of the victim administrator without their knowledge or consent, it constitutes unauthorized access through privilege escalation via client-side manipulation. This could lead to further defacement, data exfiltration from the CMS database, or installation of backdoors within the content management system itself, thereby compromising the integrity and confidentiality of the entire web application infrastructure.
Mitigation strategies primarily involve upgrading to version 5.21.2 or later, where this specific input validation issue has been resolved by implementing proper output encoding for all dynamic content rendered in HTML contexts. For organizations unable to immediately patch their systems due to operational constraints, temporary mitigations should focus on restricting access to the Media Manager addon and administrative interfaces to trusted personnel only. Additionally, deploying a Web Application Firewall with rules capable of detecting and blocking common XSS payloads in HTTP requests can provide an additional layer of defense against exploitation attempts while permanent fixes are being deployed. Regular security audits focusing on input validation and output encoding practices across all CMS modules are recommended to prevent similar vulnerabilities from arising in other parts of the application.