PHP Content Management System Vulnerability in REDAXO

CVE-2026-63002

What is CVE-2026-63002?

REDAXO, a popular PHP-based content management system, contains a vulnerability in its media synchronization functionality. Specifically, prior to version 5.21.2, the application fails to properly escape filenames from unregistered files destined for the media directory. This allows an attacker to embed HTML metacharacters within these filenames. Consequently, when a backend user with media[sync] permission accesses the Sync page, it can lead to the execution of malicious scripts within their browser, posing a risk for session theft and unauthorized actions in the backend. This issue highlights the importance of proper input validation in web applications and has been rectified in the latest version, 5.21.2.

References