REDAXO CMS CVE-2026-63000

Exploitation requires that (1) the target is running REDAXO core <= 5.21.1 with the 'install' addon present, (2) a user who is an authenticated administrator (the execute() method enforces isAdmin()) has an active backend session, and (3) that admin is socially engineered into visiting an attacker-controlled page while logged in (UI:R). The attacker needs no credentials of their own but must know or guess a valid addonkey and target file id. Full RCE additionally requires a supply-chain compromise of a redaxo.org package or the existence of a known-vulnerable prior version to downgrade to; absent that, impact is limited to forced/unwanted updates and site disruption. These admin-session and user-interaction requirements meaningfully limit real-world exploitation.

This is a genuine but conditional-risk flaw, not a drop-everything emergency. The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:L, base 6.4) is internally consistent with a classic CSRF: PR:N reflects that the attacker themselves is unauthenticated (they ride the victim admin's session), UI:R captures that a logged-in admin must be lured to a malicious page, and AC:H reflects the timing/social-engineering conditions plus the need for the target to be an authenticated admin. No EPSS score, KEV entry, or automatability signal is provided in the input, so there is NO evidence of active exploitation - the correct reading is that this is a targeted, victim-interaction-dependent issue rather than a mass-scanned worm candidate. A working PoC (a single <img> tag) is published in the GitHub Security Advisory (GHSA-m8r3-22v6-g877), so exploit code effectively exists, but that must not be conflated with active exploitation. The headline 'RCE' impact is conditional: the description explicitly states RCE only materializes if chained with a supply-chain compromise of a package on redaxo.org OR a forced downgrade to a known-vulnerable addon version - otherwise the realistic impact is forced/unwanted updates and site disruption. Net: real and worth patching, but the AC:H + UI:R gating and lack of exploitation telemetry keep real-world risk in the moderate band.

An attacker crafts a web page containing an auto-loading image (or hidden request) pointing at the victim's REDAXO backend install-package-update endpoint with a chosen addonkey and file id, then lures a logged-in administrator to visit it. The admin's browser silently replays the request with their session cookie, forcing the specified addon to be updated/downgraded to an attacker-chosen version; a public PoC exists in the vendor advisory. If the targeted version is known-vulnerable or the package is supply-chain compromised, this escalates to code execution on the server.