Is CVE-2026-62998 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62998 being exploited in the wild.

How severe is CVE-2026-62998?

Medium severity, with a CVSS score of 4.3, published 23 September 2026.

Is there a fix for CVE-2026-62998?

Yes. redaxo/source (Packagist): upgrade to 5.21.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-62998 attacked?

It is attacked over the network.

Am I affected by CVE-2026-62998?

Check whether you run redaxo/source (Packagist) or REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62998: REDAXO rex_list unwhitelisted ORDER BY column injection

CVE-2026-62998 · Severity: medium · CVSS 4.3 · Published 2026-09-23

REDAXO is a content management system used to manage website content and backend users. An authenticated backend user can manipulate database query sorting to access sensitive unselected columns (such as password hashes and internal metadata) and enumerate database column names through error messages, potentially enabling targeted attacks against administrative accounts.

Technologies: redaxo/source (Packagist), REDAXO. Vendors: Packagist, REDAXO.

Quick answers

Is CVE-2026-62998 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62998 being exploited in the wild.
How severe is CVE-2026-62998?: Medium severity, with a CVSS score of 4.3, published 23 September 2026.
Which products and versions are affected?: redaxo/source (Packagist) <= 5.21.1, ECOSYSTEM:introduced=0,fixed=5.21.2; REDAXO <UNKNOWN>.
Is there a fix for CVE-2026-62998?: Yes. redaxo/source (Packagist): upgrade to 5.21.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62998 attacked?: It is attacked over the network.
Am I affected by CVE-2026-62998?: Check whether you run redaxo/source (Packagist) or REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

redaxo/source (Packagist): upgrade to 5.21.2 or later
```
composer require redaxo/source:^5.21.2
```

Technical details

The vulnerability is an insufficient input validation flaw in the `rex_list` component (file `redaxo/src/core/lib/list.php`). The `getSortColumn()` method reads the `sort` GET parameter and passes it directly to the ORDER BY clause without checking it against the whitelist of columns registered via `setColumnSortable()`. Although the column name is wrapped in backticks via `escapeIdentifier()` to prevent classical SQL injection, an attacker can still order results by any column in the underlying tables, including sensitive unselected columns like `password`, `previous_passwords`, and `password_change_required` from the `rex_user` table. An error-based enumeration technique allows authenticated backend users to determine column existence by observing database error messages (e.g., "Unknown column in 'order clause'"). Attack requires authentication to the backend and knowledge of table names; no special privileges or user interaction are needed beyond crafting GET requests.

Affected products

REDAXO REDAXO <UNKNOWN>

Identifiers

CVE-2026-62998
GHSA-4f5f-j737-pm58

Timeline

2026-09-24: disclosed: GHSA-4f5f-j737-pm58 published
2026-09-24: advisory

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.