# redaxo/source (Packagist) vulnerabilities

18 known vulnerabilities (4 high, 12 medium, 2 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: not known (cve.now hasn't read this package's releases)
- Newest unaffected release: not known without release data
- Registry: https://packagist.org/packages/redaxo/source

## Advisories (18)

### [CVE-2026-117538](https://cve.now/CVE-2026-117538): REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

- Severity: Low 2.1
- Published: Oct 27, 2026
- Affected: fixed in 5.21.0.

### [CVE-2026-117537](https://cve.now/CVE-2026-117537): REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

- Severity: Low 2.1
- Published: Oct 27, 2026
- Affected: fixed in 5.21.0.

### [CVE-2026-63000](https://cve.now/CVE-2026-63000): REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

- Severity: Medium 6.4
- Published: Sep 23, 2026
- Affected: fixed in 5.21.2.

### [CVE-2026-62998](https://cve.now/CVE-2026-62998): REDAXO: Unwhitelisted ORDER BY Column in rex\_list Allows Authenticated Column Enumeration

- Severity: Medium 4.3
- Published: Sep 23, 2026
- Affected: fixed in 5.21.2.

### [CVE-2026-63002](https://cve.now/CVE-2026-63002): REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

- Severity: Medium 4.8
- Published: Sep 23, 2026
- Affected: fixed in 5.21.2.

### [CVE-2026-63001](https://cve.now/CVE-2026-63001): REDAXO: Stored XSS via Unescaped Media Manager Type Name in \`mediaIsInUse()\`

- Severity: Medium 4.8
- Published: Sep 23, 2026
- Affected: fixed in 5.21.2.

### [CVE-2026-53599](https://cve.now/CVE-2026-53599): Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod\_php…

- Severity: High 7.5
- Published: Jul 31, 2026
- Affected: from 5.18.2, fixed in 5.21.1.

### [CVE-2026-21857](https://cve.now/CVE-2026-21857): Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

- Severity: High 8.3
- Published: Jan 7, 2026
- Affected: fixed in 5.20.2.

### [CVE-2025-66026](https://cve.now/CVE-2025-66026): REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args\[types\]

- Severity: Medium 6.1
- Published: Nov 26, 2025
- Affected: fixed in 5.20.1.

### [CVE-2025-64050](https://cve.now/CVE-2025-64050): A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated…

- Severity: High 7.2
- Published: Nov 25, 2025
- Affected: fixed in 5.20.1.

### [CVE-2025-64049](https://cve.now/CVE-2025-64049): A stored cross-site scripting (XSS) vulnerability in the module management component in REDAXO CMS 5.20.0 allows remote users to inject…

- Severity: Medium 4.8
- Published: Nov 25, 2025
- Affected: fixed in 5.20.1.

### [CVE-2025-27412](https://cve.now/CVE-2025-27412): REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation

- Severity: Medium 6.1
- Published: Mar 5, 2025
- Affected: from 5.0.0, fixed in 5.18.3.

### [CVE-2025-27411](https://cve.now/CVE-2025-27411): REDAXO allows Arbitrary File Upload in the mediapool page

- Severity: Medium 5.4
- Published: Mar 5, 2025
- Affected: fixed in 5.18.3.

### [CVE-2024-13209](https://cve.now/CVE-2024-13209): Redaxo CMS Structure Management Page index.php cross site scripting

- Severity: Medium 5.1
- Published: Jan 9, 2025
- Affected: from 5.12.0-beta1, fixed in 5.18.2.

### [CVE-2024-46209](https://cve.now/CVE-2024-46209): A stored cross-site scripting (XSS) vulnerability in the component /media/test.html of REDAXO CMS v5.17.1 allows attackers to execute…

- Severity: Medium 5.4
- Published: Jan 6, 2025
- Affected: through 5.17.1.

### [CVE-2024-50803](https://cve.now/CVE-2024-50803): The mediapool feature of the Redaxo Core CMS application v 5.17.1 is vulnerable to Cross Site Scripting(XSS) which allows a remote…

- Severity: Medium 6.1
- Published: Nov 19, 2024
- Affected: fixed in 5.18.0.

### [CVE-2024-46212](https://cve.now/CVE-2024-46212): An issue in the component /index.php?page=backup/export of REDAXO CMS v5.17.1 allows attackers to execute a directory traversal.

- Severity: Medium 4.9
- Published: Oct 16, 2024
- Affected: through 5.17.1.

### [CVE-2024-25298](https://cve.now/CVE-2024-25298): An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via…

- Severity: High 7.2
- Published: Feb 17, 2024
- Affected: through 5.15.1.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/packagist/redaxo/source
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.