CVE-2026-63001

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63001
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63001.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63001
Aliases
Published
2026-09-23T14:03:12Z
Modified
2026-09-25T03:48:35Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`
Details

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63001.json"
}
References

Affected packages

Git / github.com/redaxo/core

Affected ranges

Type
GIT
Repo
https://github.com/redaxo/core
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c
Fixed
31d61c6a460b6c8daf09baa75d6477fa3a93a68b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "5.21.2"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

5.*
5.0.0
5.0.0-alpha7
5.0.0-beta1
5.0.0-beta2
5.0.0-rc
5.0.1
5.1.0
5.10.0
5.10.0-beta1
5.10.0-beta2
5.11.0
5.11.0-beta1
5.12.0
5.12.0-beta1
5.12.0-beta2
5.12.0-beta3
5.13.0
5.13.0-beta1
5.13.0-beta2
5.13.1
5.13.2
5.14.0
5.14.0-beta1
5.14.0-beta2
5.14.1
5.15.0
5.15.0-beta1
5.16.0
5.16.0-beta1
5.16.1
5.17.0
5.17.1
5.18.0
5.18.1
5.18.2
5.18.3
5.19.0
5.2.0
5.2.0-beta1
5.20.0
5.20.1
5.20.2
5.21.0
5.21.0-beta1
5.21.1
5.3.0
5.4.0
5.4.0-beta1
5.4.0-beta2
5.5.0
5.5.0-beta1
5.5.1
5.6.0
5.6.0-beta1
5.6.1
5.7.0
5.7.0-beta1
5.7.0-beta2
5.7.0-beta3
5.8.0
5.8.0-beta1
5.9.0
5.9.0-beta1
5.9.0-beta2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63001.json"