{"id":"CVE-2026-116900","kind":"vulnerability","aliases":["CVE-2026-116900"],"related":[],"title":"REDAXO CMS: stored XSS in media and link widgets hijacks admin sessions","description":"REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.","summary":"REDAXO versions before 5.21.4 do not escape values rendered by the media, medialist, link and linklist widgets. A content editor can store crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute and run script in administrators' backend sessions, which can be used to take over accounts.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","redaxo","self-hosted"],"not_affected_if":["no-untrusted-editors","patched-version"],"how_to_check":"- Check the installed REDAXO version in the backend or in `redaxo/src/core/boot.php` and confirm whether it is below `5.21.4`\n- Review which accounts have editor rights that can edit module or article content using the media and link widgets","fix":"- Upgrade REDAXO to `5.21.4` or later\n- Until upgraded, restrict content editor accounts to trusted users and review stored media and link values for script-like markup","status":"open","published_at":"2026-10-27T11:17:33+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","triaged_at":"2026-10-27T11:32:10+00:00","updated_at":"2026-10-27T11:32:10+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T11:32:10Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade REDAXO to `5.21.4` or later\n- Until upgraded, restrict content editor accounts to trusted users and review stored media and link values for script-like markup","reach":"network","title":"REDAXO CMS: stored XSS in media and link widgets hijacks admin sessions","impact":"high","summary":"REDAXO versions before 5.21.4 do not escape values rendered by the media, medialist, link and linklist widgets. A content editor can store crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute and run script in administrators' backend sessions, which can be used to take over accounts.","category":"package","nicknames":[],"who_cares":["redaxo","self-hosted","php"],"confidence":0.6,"needs_auth":"yes","worst_case":"script runs in admin sessions, enabling account takeover","analyst_note":"Confirm the affected version range and the fixed release notes at the NVD entry or REDAXO's changelog; sources give only 'before 5.21.4'.","how_to_check":"- Check the installed REDAXO version in the backend or in `redaxo/src/core/boot.php` and confirm whether it is below `5.21.4`\n- Review which accounts have editor rights that can edit module or article content using the media and link widgets","needs_analyst":true,"not_affected_if":["patched-version","no-untrusted-editors"],"who_is_affected":"Sites running REDAXO before 5.21.4 where content editors can enter values through the media, medialist, link or linklist widgets. The risk is highest where administrators regularly work in the backend while editors have write access to content. Sites on the patched version, or with no non-admin editors, are not exposed through this path.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000649,"input_tokens":3359,"output_tokens":626,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-116900':15A,18A '-2026':14A,17A '5.21.4':28B,80C 'account':77B,135C 'admin':11A 'administr':67B,130C 'allow':90C 'attack':108C 'attribut':62B,126C 'backend':68B,131C 'break':57B,121C 'cms':2A 'contain':81C 'content':43B,91C 'craft':47B,111C 'cross':85C 'cross-sit':84C 'cve':13A,16A 'editor':44B,92C 'escap':31B 'execut':127C 'hijack':10A,134C 'host':24B 'html':95C 'inject':94C 'input':49B,53B,113C,117C 'link':8A,38B,54B,104C,118C 'linklist':40B,106C 'media':6A,36B,50B,102C,114C 'medialist':37B,103C 'packag':19B 'php':20B 'redaxo':1A,21B,25B,78C 'render':33B,100C 'rex':48B,52B,112C,116C 'run':64B 'script':65B,87C,128C 'self':23B 'self-host':22B 'session':12A,69B,132C 'site':86C 'store':3A,46B,83C,97C 'submit':110C 'take':75B 'unescap':98C 'use':73B 'valu':32B,55B,61B,99C,119C,125C 'version':26B 'vulner':88C 'widget':9A,41B,107C 'xss':4A","nicknames":[],"mitigations":[],"who_affected":"Sites running REDAXO before 5.21.4 where content editors can enter values through the media, medialist, link or linklist widgets. The risk is highest where administrators regularly work in the backend while editors have write access to content. Sites on the patched version, or with no non-admin editors, are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116900","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116900","severity":null,"published_at":"2026-10-27T11:17:33+00:00","modified_at":"2026-10-27T11:17:33+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","fetched_at":"2026-10-27T11:31:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}