CVE-2026-63001

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.2

Description A stored cross-site scripting (XSS) issue exists in the REDAXO content management system. The mediaIsInUse() function in redaxo/src/addons/media manager/lib/media manager.php, when invoked through the MEDIA IS IN USE extension point, inserts a Media Manager type name into a backend warning HTML message without proper escaping. An administrator with access to the Media Manager can store malicious HTML in a type name variable. This payload executes in the browser of another administrator who attempts to delete media referenced by the type's effects, potentially leading to session theft or unauthorized backend actions.

Recommendations Update to version 5.21.2. As a temporary workaround, restrict administrator access to the Media Manager addon to minimize the risk of payload injection.