CVE-2025-66026: REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types]

November 25, 2025 (updated November 27, 2025)

A reflected Cross-Site Scripting (XSS) vulnerability exists in the Mediapool view where the request parameter args[types] is rendered into an info banner without HTML-escaping. This allows arbitrary JavaScript execution in the backend context when an authenticated user visits a crafted link while logged in.

References

github.com/advisories/GHSA-x6vr-q3vf-vqgq
github.com/redaxo/redaxo
github.com/redaxo/redaxo/commit/58929062312cf03e344ab04067a365e6b6ee66aa
github.com/redaxo/redaxo/security/advisories/GHSA-x6vr-q3vf-vqgq
nvd.nist.gov/vuln/detail/CVE-2025-66026

Code Behaviors & Features

Detect and mitigate CVE-2025-66026 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →