CVE-2026-63000

Published: Sep 23, 2026Modified: Oct 19, 2026

6.4

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L

Exploitability: 1.6 / Impact: 4.7

Source: security-advisories@github.com (Secondary)

Description

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator's browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator's intent. This issue is fixed in version 5.21.2.

Affected (1)

Products: Redaxo: Redaxo

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Redaxo Redaxo	version < 5.21.2

Related CWEs

Cross-Site Request Forgery (CSRF)

The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.

References (5)

https://github.com/redaxo/core/commit/a13abbffbad4fdea46a4edc86cdba3335ca9e8f3

Source: security-advisories@github.com

Patch

https://github.com/redaxo/core/pull/6579

Source: security-advisories@github.com

Issue TrackingPatch

https://github.com/redaxo/core/releases/tag/5.21.2

Source: security-advisories@github.com

Release Notes

https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877

Source: security-advisories@github.com

ExploitVendor Advisory

https://github.com/redaxo/core/security/advisories/GHSA-m8r3-22v6-g877

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitVendor Advisory

Timeline

No history available yet.