REDAXO EUVD-2026-110803

Exploitation requires an authenticated backend session (PR:H) AND a valid session-bound CSRF token for the Packages page (reflected in AT:P); per the GHSA PoC the token must be retrieved from an already-valid backend/admin PHPSESSID, so the attacker effectively needs access tied to the victim's authenticated session. The victim must also follow a crafted link to the backend packages API (page=packages&rex-api-call=package&function=<payload>), so successful attacks depend on user interaction and a non-nonexistent package value triggering the 'Unknown package function' error path. These prerequisites - valid backend auth, a valid CSRF token, and luring a logged-in user - are the primary limiting factors; the flaw affects REDAXO core before 5.21.0.

This is a low-priority, high-caveat issue rather than an urgent threat, and the signals are internally consistent. The vendor CVSS 4.0 score is 2.1 (Low) with vector AV:N/AC:L/AT:P/PR:H/UI:N, and the vuln.today decision label is 'monitor' - all pointing to low real-world urgency. No EPSS score and no KEV listing are provided, so there is no evidence of active exploitation; per the input this is not a CISA KEV entry. A full working proof-of-concept (Python exploit plus demo videos) is published directly in the GHSA advisory, so exploit code is public, but PoC availability is a distinct signal from active exploitation and must not be conflated. The CVSS vector carries PR:H, so exploitation requires an authenticated high-privilege backend user; combined with AT:P this reflects the hard prerequisite that the attacker must supply a valid per-session CSRF token. The PoC itself underscores this limitation: it retrieves the CSRF token using an already-valid admin PHPSESSID, meaning realistic exploitation approaches a self-XSS/already-authenticated scenario rather than broad remote compromise. Note one modeling tension: the 4.0 vector sets UI:N, yet the description explicitly requires luring a backend user to click a crafted link - real user interaction - which argues the vendor under-counted UI. Impact is uniformly Low (VC:L/VI:L/VA:L) with no scope change to other systems.

An attacker who can obtain a valid backend CSRF token for a target's session crafts a malicious packages-API link embedding a JavaScript payload in the 'function' parameter, then lures an authenticated REDAXO backend user into clicking it; the unescaped error message reflects the payload and executes script in the victim's authenticated session, enabling same-origin requests or reading DOM data. A complete working PoC and demo are published in the GHSA advisory. The requirement for a valid session-bound CSRF token (which the PoC obtains from an existing admin session) sharply limits realistic, remote-at-scale exploitation.