CVE-2025-66026 REDAXO is Vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

What is CVE-2025-66026?

CVE-2025-66026 is a medium-severity cross-site scripting vulnerability in redaxo, published on 26 Nov 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

REDAXO is a PHP-based CMS. Prior to version 5.20.1, a reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in. This issue has been patched in version 5.20.1.

Weakness: CWE-79

Which versions are affected by CVE-2025-66026?

2 open source packages ship an affected version, including redaxo/source. It affects 1 product.

Products include Redaxo Redaxo.

How do I fix CVE-2025-66026?

Upgrade redaxo/source to 5.20.1 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2025-66026 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-66026 exists.

Other vulnerabilities in redaxo

• CVE-2018-18200 SQL injection in n/a Critical 9.8
• CVE-2018-17831 SQL injection in n/a Critical 9.8
• CVE-2026-21857 Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read High 8.3
• CVE-2006-2843 Code injection in n/a High 7.5
• CVE-2006-2844 Multiple PHP remote file inclusion vulnerabilities in Redaxo 3.0 allow remote attackers to execute arbitrary PHP code via a URL in the REX[I High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-x6vr-q3vf-vqgq.