REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

published 2026-09-23 47 d ago modified 2026-10-19 20 d ago also GHSA-mf2p-wjp4-99pq , EUVD-2026-85329

cvss: 4.8; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.2%; EPSS 0.2% chance of exploitation in 30 days, percentile 9%
public exploits: 0; none known

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

Patch / fix

fixed in 2 links 3

packagist redaxo/source 5.21.2
redaxo redaxo 5.21.2

github.com/redaxo/core@2daaa3a commit
github.com/redaxo/core#6581 pull request
github.com/redaxo/core/releases/tag/5.21.2 release

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 46 d ago (2026-09-23)

Exploit prediction

0.20% chance of exploitation in the next 30 days, higher than 9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
GitHub	3.1	4.8	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	redaxo/source	<5.21.2	5.21.2

Affected products

redaxo core

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

github.com /redaxo/core/pull/6581
web, issue-tracking, patch
github.com /redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c
web, patch
github.com /redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq
web, exploit, vendor-advisory
github.com /redaxo/core/releases/tag/5.21.2
web, release-notes
github.com /redaxo/core
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary