CVE-2025-66026

REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in. This issue has been patched in version 5.20.1.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/redaxo/redaxo/commit/58929062312cf03e344ab04067a365e6b6ee66aa	Patch
https://github.com/redaxo/redaxo/security/advisories/GHSA-x6vr-q3vf-vqgq	Exploit Vendor Advisory
https://github.com/redaxo/redaxo/security/advisories/GHSA-x6vr-q3vf-vqgq	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*

History

18 Oct 2026, 20:10

Type	Values Removed	Values Added
Summary		(es) REDAXO es un CMS basado en PHP. Versiones anteriores a la versión 5.20.1, existe una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en la vista Mediapool donde el parámetro de solicitud args[types] se renderiza en un banner de información sin escape HTML. Esto permite la ejecución arbitraria de JavaScript en el contexto del backend cuando un usuario autenticado visita un enlace manipulado mientras ha iniciado sesión. Este problema ha sido parcheado en la versión 5.20.1.

Information

Published : 2025-11-26 03:15

Updated : 2026-10-18 20:10

NVD link : CVE-2025-66026

Mitre link : CVE-2025-66026

CVE.ORG link : CVE-2025-66026

JSON object : View

Products Affected

redaxo

redaxo

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2025-66026", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-66026", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-26T15:14:33.326471Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "redaxo", "product": "redaxo", "versions": [{"status": "affected", "version": "< 5.20.1"}]}]}], "published": "2025-11-26T03:15:58.440", "references": [{"url": "https://github.com/redaxo/redaxo/commit/58929062312cf03e344ab04067a365e6b6ee66aa", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/redaxo/redaxo/security/advisories/GHSA-x6vr-q3vf-vqgq", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/redaxo/redaxo/security/advisories/GHSA-x6vr-q3vf-vqgq", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in. This issue has been patched in version 5.20.1."}, {"lang": "es", "value": "REDAXO es un CMS basado en PHP. Versiones anteriores a la versi\u00f3n 5.20.1, existe una vulnerabilidad de Cross-Site Scripting (XSS) reflejado en la vista Mediapool donde el par\u00e1metro de solicitud args[types] se renderiza en un banner de informaci\u00f3n sin escape HTML. Esto permite la ejecuci\u00f3n arbitraria de JavaScript en el contexto del backend cuando un usuario autenticado visita un enlace manipulado mientras ha iniciado sesi\u00f3n. Este problema ha sido parcheado en la versi\u00f3n 5.20.1."}], "lastModified": "2026-10-18T20:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9937DEF0-5450-4350-ADC0-95D0CC89958B", "versionEndExcluding": "5.20.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}