REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

Medium · CVSS 4.8

### Summary A stored cross-site scripting (XSS) vulnerability exists in REDAXO CMS 5.x. When an administrator attempts to delete a media file that is referenced by a Media Manager effect, the warning message rendered in the backend includes the type's `name` field without HTML escaping. This can lead to session hijacking and full backend account takeover.

Remediation

Upgrade redaxo/source to 5.21.2 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-mf2p-wjp4-99pq

← All threats