# CVE-2025-66026: REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

Source: https://junglewise.ai/threats/cve-2025-66026-redaxo-cms-is-vulnerable-to-reflected-xss-in-mediapool-info  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-26  
License: CC BY 4.0 with a link back

CVE-2025-66026 · Severity: medium · CVSS 6.1 · Published 2025-11-26

REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in. This issue has been patched in version 5.20.1.

Technologies: [redaxo/source (Packagist)](https://junglewise.ai/threats/technologies/redaxo-source), [REDAXO](https://junglewise.ai/threats/technologies/redaxo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [REDAXO](https://junglewise.ai/threats/vendors/redaxo).

## Quick answers

**Is CVE-2025-66026 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66026 being exploited in the wild.

**How severe is CVE-2025-66026?** Medium severity, with a CVSS score of 6.1, published 26 November 2025.

**Which products and versions are affected?** redaxo/source (Packagist) ECOSYSTEM:introduced=0,fixed=5.20.1.

**Is there a fix for CVE-2025-66026?** Yes. redaxo/source (Packagist): upgrade to 5.20.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2025-66026?** Check whether you run redaxo/source (Packagist) or REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- redaxo/source (Packagist): upgrade to 5.20.1 or later

  ```sh
  composer require redaxo/source:^5.20.1
  ```


## Affected products

- redaxo/source (Packagist) ECOSYSTEM:introduced=0,fixed=5.20.1
- REDAXO

## Identifiers

- CVE-2025-66026
- GHSA-x6vr-q3vf-vqgq

## Related threats

- [REDAXO reflected XSS in metainfo API type parameter](https://junglewise.ai/threats/cve-2026-117537-redaxo-before-5-21-0-contains-a-reflected-cross-site-scripting)
- [REDAXO CSRF token bypass in user administration](https://junglewise.ai/threats/cve-2026-117536-redaxo-before-5-21-3-contains-a-cross-site-request-forgery)
- [REDAXO reflected cross-site scripting in media pool](https://junglewise.ai/threats/cve-2026-117535-redaxo-before-5-21-3-contains-a-reflected-cross-site-scripting)
- [REDAXO cross-site request forgery in article history plugin](https://junglewise.ai/threats/cve-2026-117534-redaxo-before-5-21-3-contains-a-cross-site-request-forgery)
- [REDAXO stored cross-site scripting in mediapool SVG uploads](https://junglewise.ai/threats/cve-2026-117533-redaxo-from-5-18-0-before-5-21-4-contains-a-stored-cross-site)