REDAXO EUVD-2026-110796

The attacker must hold a backend account with content-editing or metadata-editing permission in REDAXO (PR:L) to store a crafted REX_INPUT_MEDIA, REX_INPUT_MEDIALIST, REX_INPUT_LINK or REX_INPUT_LINKLIST value; the readonly attribute on the widget is a client-side hint only and does not stop submission. Execution additionally requires a victim user - typically an administrator - to subsequently open a form that renders the poisoned widget (the slice editor, metainfo fields on articles/categories/media/users, or any rex_form using these widgets), satisfying the passive UI requirement. The vendor states there is no configuration-level workaround; the only complete fix is updating to 5.21.4, and interim risk can only be reduced by limiting content and metadata editing to trusted users. REX_VALUE is unaffected because it escapes by default, and the frontend output of REX_MEDIA/REX_LINK is intentionally unchanged.

This is a stored XSS (CWE-79/CWE-116) in REDAXO's media, medialist, link and linklist backend input widgets, rated 5.1 (Medium) on the supplied CVSS 4.0 vector AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N. The signals are internally consistent and point to a moderate, not emergency, priority: the attacker must already hold a backend content-editing account (PR:L), and exploitation is passive - it only fires when another user, typically an administrator, opens a form containing the poisoned widget (UI:P). There is no CISA KEV listing and no EPSS score in the supplied data, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month', consistent with a prioritized-but-not-urgent fix. The GHSA advisory includes a concrete breakout payload demonstrating the flaw, so a public PoC reference exists, but it is not verified as packaged working exploit code and PoC availability must not be conflated with active exploitation. The practical risk is privilege escalation: a lower-privileged editor can take over an administrator session and thereby the whole installation, which raises the real-world impact above what the 5.1 base score alone suggests, but the requirement for an existing trusted-ish editor account and victim interaction meaningfully constrains it. No key data conflicts; EPSS and KEV are simply absent (expected for a non-exploited medium-severity CMS XSS).

A user with content-editing (or metadata-editing) permission submits a crafted REX_INPUT_MEDIA or REX_INPUT_LINK value such as " onfocus=alert(document.domain) autofocus x=", which is written to the slice/metadata row unescaped despite the client-side readonly hint. When an administrator later opens the article in the slice editor (or any rex_form using these widgets), the value breaks out of the input's value attribute and the injected script executes in the admin's authenticated backend session, allowing session-cookie/CSRF-token theft and backend actions that lead to account takeover. The GHSA advisory demonstrates the breakout payload; it is a public PoC reference, not verified as packaged working exploit code.