Redaxo vulnerabilities
We track 8 vulnerabilities in Redaxo products across 2 products. 8 are rated high or critical, and none are known to be exploited. The most recent was published on October 27, 2026.
Latest Redaxo vulnerabilities
- 8.8 High severity
core: Cross-Site Request Forgery
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page (users/users) because the CSRF token check only runs when the save parameter is set, while the update path triggered by FUNC_UPDATE does not requir
- 9.8 Critical severity
core: Improper Authentication
REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin that allows unauthenticated attackers to forge temporary login tokens. Attackers can force the session-tied secret into a predictable state and
- 7.1 High severity
core: Authorization Bypass Through User-Controlled Key
REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target category permission, ignoring the source category. Authenticated backend users with permission for one media category can move files from re
- 7.5 High severity
core: Missing Authorization
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other applications' tables. At
- 7.5 High severity
core: Unrestricted Upload of File with Dangerous Type
REDAXO is a PHP-based content management system. From 5.18.2 until 5.21.1, rex_mediapool::isAllowedExtension in redaxo/src/addons/mediapool/lib/mediapool.php lets an authenticated backend user with media[upload] permission upload a JPEG/PHP polyglot named shel
- 7.2 High severity
Redaxo: Improper Control of Generation of Code
A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows remote authenticated administrators to execute arbitrary operating system commands by injecting PHP code into an active template. The payload is execut
- 7.2 High severity
Redaxo: Unrestricted Upload of File with Dangerous Type
An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execute arbitrary code via uploading a crafted file.
- 7.2 High severity
redaxo: Improper Control of Generation of Code
An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.modules.php.