CVE-2026-116900: REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets
REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REXINPUTMEDIA or REXINPUTLINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs content-editor privileges and must be able to submit crafted values through the affected media, medialist, link, or linklist input widgets. Exploitation also requires an administrator to view the stored content in a backend session.
Which deployments are affected?
REDAXO versions before 5.21.4 are affected where the vulnerable widgets are used to render stored, unescaped values. The issue is in backend rendering, so administrators who review affected content are the users at risk of script execution.
What can happen after successful exploitation?
The injected script executes in an administrator's backend session. This can allow the attacker to hijack the administrator's account and access data or perform actions available to that session.
How can I determine whether I may already be affected?
Review content created or edited by users with editor privileges for suspicious values in REX_INPUT_MEDIA or REX_INPUT_LINK fields, especially values containing HTML or attribute-breaking characters. Also investigate unexpected administrator-session activity, since successful exploitation targets backend administrator sessions.