CVE-2026-21857

CVE-2026-21857: Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Overview Field| Details ---|--- CVE ID| CVE-2026-21857 Severity| HIGH Advisory| View Advisory Discovered by| Lukasz Rybak Affected Products redaxo/source versions: = 5.20.1 CWE Classification CWE-22: Improper...

CVE-2024-46209

Redaxo Security Research CVE-2024-46209, CVE-2024-46210 Redaxo CMS v5.17.1 security research Completed at 09 August 2024 Contains detailed description of: CVE-2024-46210 - Stored Cross-Site Scripting via file Upload in MediaPool module CVE-2024-46209 - Authenticated arbitrary code execution...

CVE-2024-50803-Redaxo

CVE-2024-50803 Stored XSS in mediapool feature of Redaxo A stored cross-site scripting XSS vulnerability was found in Redaxo versions 5.18.0, allowing attackers with sufficient privileges to upload a malicious SVG file through the mediapool feature. Published a write-up :...

CVE-2026-117535

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the openerlink parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The...

CVE-2026-117537

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfodefaultfieldscreate API. Attackers can craft a link with a valid CSRF token and HTML payload that rexview::message renders...

CVE-2026-117538

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF...

CVE-2026-117536

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page users/users because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNCUPDATE does not require it. Attackers can lure a logged-in...

CVE-2026-117534

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or...

CVE-2026-117533

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rexmediaservice moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave...

CVE-2026-116900

REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REXINPUTMEDIA or REXINPUTLINK values that break out of the value...

CVE-2026-117532

REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and forge tokens for accounts like admin...

CVE-2026-116895

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safemode:...

CVE-2026-116896

REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backupexport permission to export rexuser, rexusersession, and other applications' tables. Attackers can obtain plaintext session ids a...

CVE-2026-116898

REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from restricted categories into it, then...

CVE-2026-116894

REDAXO before 5.21.5 contains an insufficient session expiration vulnerability that allows attackers to retain account access by keeping the current session and stay-logged-in key valid after a password change. Attackers who obtained a user's session id or stay-logged-in cookie can keep backend...

CVE-2026-116899

REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices in unauthorized categories by pairing a permitted article with a foreign slice id. Attackers can abuse content/edit delete and edit functions or the contentslicestatus and...

CVE-2026-116893

REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rexapipackage API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admins with active sessions, can uninstall system addons like...

CVE-2026-116897

REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user, or one holding historyarticlerollback, can set rexversion o...

EUVD-2026-110803

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF...

EUVD-2026-110802

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfodefaultfieldscreate API. Attackers can craft a link with a valid CSRF token and HTML payload that rexview::message renders...