CVE-2026-63001

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

• CWE-79

• https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c
• https://github.com/redaxo/core/pull/6581
• https://github.com/redaxo/core/releases/tag/5.21.2
• https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq

Published

Sep 23, 2026

Last Modified

Sep 23, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62996Smarty is a template engine for PHP, facilitating the separa…6.9
• CVE-2026-62997Kedro-Datasets provides data connectors for Kedro. From vers…7.7
• CVE-2026-62998REDAXO is a PHP-based content management system. Prior to 5.…4.3
• CVE-2026-62999Copier is a library and CLI app for rendering project templa…7.5
• CVE-2026-6300Use after free in CSS in Google Chrome prior to 147.0.7727.1…8.8
• CVE-2026-63000REDAXO is a PHP-based content management system. Prior to 5.…6.4
• CVE-2026-63002REDAXO is a PHP-based content management system. Prior to 5.…4.8
• CVE-2026-63003django CMS is an easy-to-use and developer-friendly enterpri…6.5
• CVE-2026-63004Unleash is an open-source feature management platform. Prior…5.5
• CVE-2026-63006Zammad is a web based open source helpdesk/customer support …5.3
• CVE-2026-6301Type Confusion in Turbofan in Google Chrome prior to 147.0.7…8.8
• CVE-2026-63015Uncontrolled Resource Consumption vulnerability in Apache In…4.3