CVE-2025-27412: REDAXO Package Vulnerability Leading to Authenticated Reflected XSS
Summary
CVE-2025-27412: REDAXO allows Authenticated Reflected Cross Site Scripting - packages installation. Affects redaxo/source versions >= 5.0.0, < 5.18.3. Fixed in 5.18.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
REDAXO is an open-source content management system (CMS) that allows users to create and manage websites with ease. It offers a modular architecture, enabling the installation of various add-ons to extend functionality. However, a vulnerability has been identified in version 5.18.2, specifically in the handling of user input in the AddOns page, which can lead to security risks.
Vulnerability Detail
The vulnerability is a reflected cross-site scripting (XSS) issue that arises from improper sanitization of the 'rex-api-result' parameter in the AddOns page of REDAXO. An attacker can exploit this flaw by crafting a malicious URL that, when accessed by an administrative user, executes arbitrary JavaScript code in the user's browser. This could lead to session hijacking, phishing attacks, or malware distribution, compromising sensitive information and potentially granting elevated privileges to the attacker.
How To Fix
Minimum fixed version
5.18.3
This is the first release that contains the fix.
composer require redaxo/source:5.18.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid accessing the vulnerable URL with the 'rex-api-result' parameter until the package is updated. Additionally, implement input validation and output encoding in your application to minimize the risk of XSS attacks.
Conclusion
The identified vulnerability in REDAXO (CVE-2025-27412) poses significant risks to administrative users due to reflected XSS. It is crucial to update to the latest version to mitigate these risks and ensure the security of your application.
See every vulnerability recorded for redaxo/source →
FAQ
The vulnerability is a reflected cross-site scripting (XSS) issue that allows attackers to execute malicious scripts in the context of an authenticated user's session.
Any administrative user of REDAXO version 5.18.2 is at risk when accessing the AddOns page with the vulnerable parameter.
You can use Vulert's playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to session hijacking, unauthorized access to sensitive data, and potential control over the user's account.
Yes, the CVSS score for this vulnerability is 6.1, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for redaxo/source.
