---
id: CVE-2026-63001
title: REDAXO is a PHP-based content management system
summary: >-
  REDAXO is a PHP-based content management system. Prior to 5.21.2, the
  mediaIsInUse() handler in
  redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager
  type name into raw backend warning HTML without escaping it whe…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: redaxo
product: core
affected:
  - core < 5.21.2
patched:
  - redaxo/source 5.21.2
published: '2026-09-23'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T20:17:12.363'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63001'
references:
  - url: >-
      https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c
    label: security-advisories@github.com
  - url: 'https://github.com/redaxo/core/pull/6581'
    label: security-advisories@github.com
  - url: 'https://github.com/redaxo/core/releases/tag/5.21.2'
    label: security-advisories@github.com
  - url: 'https://github.com/redaxo/core/security/advisories/GHSA-mf2p-wjp4-99pq'
    label: security-advisories@github.com
  - url: 'https://github.com/advisories/GHSA-mf2p-wjp4-99pq'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-23T18:17:12.653764Z'
aliases:
  - GHSA-mf2p-wjp4-99pq
ecosystem: composer
ingestedAt: '2026-09-23T14:25:29.805Z'
epss: 0.00183
epssPercentile: 0.07022
---

## Overview

REDAXO is a PHP-based content management system. Prior to 5.21.2, the mediaIsInUse() handler in redaxo/src/addons/media_manager/lib/media_manager.php inserts a Media Manager type name into raw backend warning HTML without escaping it when invoked through MEDIA_IS_IN_USE. An administrator with Media Manager access can store HTML in a type name, and the payload executes in another administrator's browser when that administrator tries to delete media referenced by the type's effects, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63001)

Affected packages:

- `redaxo/source <= 5.21.1`

Patched in:

- `redaxo/source 5.21.2`

Source: https://github.com/advisories/GHSA-mf2p-wjp4-99pq