CVE-2025-66026
Medium · 6.1REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]
CVSS
6.1
EPSS
0.3%
Published
Nov 25, 2025
CISA due date
—
The record
A reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter `args[types]` is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | redaxo/source | 0 | 5.20.1 |
Related vulnerabilities
- GHSA-x6vr-q3vf-vqgq REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] Same vulnerability
- GHSA-824x-88xg-cwrv Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Also affects redaxo/source
- CVE-2026-21857 Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Also affects redaxo/source
- GHSA-vqc7-7fj4-3fm3 REDAXO CMS is vulnerable to XSS through its module management component Also affects redaxo/source
- GHSA-xj9j-gjxg-7jvq REDAXO CMS is vulnerable to RCE attack through its template management component Also affects redaxo/source
- CVE-2025-64050 REDAXO CMS is vulnerable to RCE attack through its template management component Also affects redaxo/source
- CVE-2025-64049 REDAXO CMS is vulnerable to XSS through its module management component Also affects redaxo/source
- CVE-2026-96379 Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")… CWE-79