Executive brief
REDAXO CMS is a content management system used to build and manage websites. An administrator with access to the Media Manager addon can inject malicious code into a media type name. When any other administrator tries to delete a media file linked to that type, the injected code executes in their browser session, allowing account takeover or credential theft.
Technical details
A stored XSS vulnerability exists in REDAXO 5.x's Media Manager addon, specifically in the `mediaIsInUse()` function in `redaxo/src/addons/media_manager/lib/media_manager.php`. When a media file deletion is attempted, the function constructs an HTML warning message that includes the media type's name field without HTML escaping via `rex_escape()`. The vulnerable code directly concatenates `$sql->getValue('name')` into an HTML anchor tag. An attacker with administrator privileges can store an XSS payload (e.g., `<img src=x onerror=alert(...)>`) in a media type name, which persists in the database. When any administrator subsequently tries to delete a media file referenced by that type's effects, the payload executes in their browser with full session privileges. Input validation in `types.php` line 200 does not block HTML/JavaScript-relevant characters. The fix requires adding `rex_escape()` around the name value before HTML concatenation.
Affected products
- REDAXO REDAXO 5.x
Timeline
- 2026-09-23: disclosed
- 2026-09-23: advisory: GHSA-mf2p-wjp4-99pq