REDAXO CMS EUVD-2026-110800

Exploitation requires a logged-in REDAXO backend user who holds media permissions to click an attacker-crafted link to /redaxo/index.php?page=mediapool/media with a malicious opener_link value; the attacker needs no account. Two concrete conditions from the advisory must hold: opener_input_field must be ABSENT from the request (if present, the server overwrites opener_link with a safe link), and file_id must reference an existing media file (trivial, since IDs are sequential starting at 1). Delivery must be a top-level link click - click-less loading via <img> or <iframe> does NOT trigger it because the payload relies on a SameSite=Lax GET navigation. Escalation to code execution additionally requires the victim to be an administrator (for template/module edits); non-admin victims are limited to actions their role permits. The backend sends only Content-Security-Policy: frame-ancestors 'self', so no script CSP blocks the inline handler.

This is a genuine but conditional medium-severity issue rather than a drop-everything emergency, and the signals are internally consistent. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A, base 5.1) correctly captures the core tension: the attacker needs no account of their own (PR:N), but exploitation is gated on active user interaction (UI:A) - specifically a logged-in REDAXO backend user with media permissions must click an attacker-supplied link. The vendor's own advisory confirms click-less delivery via <img>/<iframe> does NOT work because the payload fires on a top-level GET navigation (SameSite=Lax), so social engineering of a privileged user is a hard prerequisite. The subsequent-system impact (SC:L/SI:L) reflects the realistic worst case: the HttpOnly session cookie cannot be stolen, but the in-DOM CSRF token can, enabling authenticated actions bounded by the victim's role - escalating to effective code execution (template/module edits) only when the victim is an administrator. No EPSS score and no CISA KEV entry are present in the input, so there is no evidence of active or widespread exploitation; the vuln.today decision label is 'this_month,' not act_now/emergency. The RCE tag is real but contingent on admin victim interaction, so it should not be read as unauthenticated remote code execution. Net: patch on a normal priority cycle, prioritizing instances with many administrator accounts.

An attacker emails or messages a REDAXO administrator a link that appears to point to the backend media pool but carries a crafted opener_link parameter containing a JavaScript payload. When the logged-in admin clicks it, the script executes in the backend origin, reads the CSRF token from the DOM, and silently submits a template or module edit that plants PHP, yielding code execution on the server. A working example payload URL is published in the GHSA advisory, though it is a demonstration string rather than packaged weaponized exploit code.