CVE-2026-21857

CVE-2026-21857：Redaxo 备份插件存在路径遍历漏洞，可导致任意文件读取 概述 字段| 详情 ---|--- CVE ID| CVE-2026-21857 严重级别| 高危 安全公告| 查看公告 发现者| Lukasz Rybak 受影响产品 redaxo/source （版本：= 5.20.1） CWE 分类 CWE-22：对受限目录的路径名限制不当（'路径遍历'） CWE-24：路径遍历：'../filedir' 详细信息 摘要 拥有备份权限的已认证用户可通过备份插件文件导出功能中的路径遍历漏洞，读取 Web 根目录内的任意文件。 详情 备份插件未将 EXPDIR...

CVE-2024-50803-Redaxo

CVE-2024-50803 XSS almacenado en la función mediapool de Redaxo Se encontró una vulnerabilidad de cross-site scripting XSS almacenado en las versiones de Redaxo 5.18.0, que permite a atacantes con privilegios suficientes subir un archivo SVG malicioso a través de la función mediapool. Publicado u...

CVE-2024-46209

Redaxo 安全研究（CVE-2024-46209、CVE-2024-46210） Redaxo CMS v5.17.1 安全研究 完成于 2024 年 8 月 9 日 包含以下内容的详细描述： CVE-2024-46210 - MediaPool 模块中通过文件上传实现的存储型跨站脚本（Stored XSS） CVE-2024-46209 - 经过身份验证的任意代码执行...

EUVD-2026-85332

REDAXO: Unwhitelisted ORDER BY Column in rexlist Allows Authenticated Column Enumeration...

REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Summary The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable. Although the value is wrapped in backticks via escapeIdentifier preventing classical SQL injection, this still...

Information Exposure

Overview Affected versions of this package are vulnerable to Information Exposure in the getSortColumn process. An attacker can access sensitive database column names and manipulate the ordering of query results by supplying arbitrary values to the sort parameter, which are not validated against...

GHSA-4F5F-J737-PM58 REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

Summary The rexlist component reads the SQL sort column directly from the sort GET parameter without validating it against the set of columns declared sortable via setColumnSortable. Although the value is wrapped in backticks via escapeIdentifier preventing classical SQL injection, this still...

CVE-2026-63001

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:08+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq...

CVE-2026-63002

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:06+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m...

CVE-2026-63000

creationtimestamp| type| source ---|---|--- 2026-09-23 16:35:04+00:00| published-proof-of-concept| https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877 2026-09-23 18:31:57+00:00| seen| https://gist.github.com/alon710/c6373b33ac6c019650400085845933ec...

CVE-2026-63001

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse handler in redaxo/src/addons/mediamanager/lib/mediamanager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIAISINUSE. An administrator with Media...

CVE-2026-62998

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexlist::getSortColumn in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable registered the requested column. An authenticated backend user can make prepareQuery add an escape...

CVE-2026-63002

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rexescape. An attacker who can place an unregistered file with HTML metacharacters in th...

CVE-2026-63000

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the rexapiinstallpackageupdate process. An attacker can trigger unauthorized addon updates by luring an authenticated admin to visit a malicious page, causing unintended package updates or downgrades t...

GHSA-M8R3-22V6-G877 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Summary The rexapiinstallpackageupdate API function install addon does not override requiresCsrfProtection, which defaults to false in the base class rexapifunction. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO packag...

REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

Summary The rexapiinstallpackageupdate API function install addon does not override requiresCsrfProtection, which defaults to false in the base class rexapifunction. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO packag...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...

CVE-2026-63000 REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

REDAXO is a PHP-based content management system. Prior to 5.21.2, rexapiinstallpackageupdate in redaxo/src/addons/install/lib/api/apipackageupdate.php inherits the false default from rexapifunction::requiresCsrfProtection instead of requiring a CSRF token. An unauthenticated attacker can cause a...