Redaxo Core vulnerabilities

• opnsense core REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation CVE-2026-117536 8.6 HighOctober 27, 2026
• opnsense core REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool CVE-2026-117535 5.1 MediumOctober 27, 2026
• opnsense core REDAXO before 5.21.3 CSRF in Article History Plugin CVE-2026-117534 5.1 MediumOctober 27, 2026
• opnsense core REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads CVE-2026-117533 2.1 LowOctober 27, 2026
• opnsense core REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin CVE-2026-117532 Public exploit 9.3 CriticalOctober 27, 2026
• opnsense core REDAXO before 5.21.4 Stored XSS via Media and Link Input Widgets CVE-2026-116900 5.1 MediumOctober 27, 2026
• opnsense core REDAXO before 5.21.4 Broken Access Control in Slice Operations CVE-2026-116899 7.1 HighOctober 27, 2026
• opnsense core REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move CVE-2026-116898 7.1 HighOctober 27, 2026
• opnsense core REDAXO before 5.21.4 Missing Authorization in Version and History Previews CVE-2026-116897 7.1 HighOctober 27, 2026
• opnsense core REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables CVE-2026-116896 7.7 HighOctober 27, 2026
• opnsense core REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter CVE-2026-116895 5.1 MediumOctober 27, 2026
• opnsense core REDAXO before 5.21.5 Insufficient Session Expiration on Password Change CVE-2026-116894 2.3 LowOctober 27, 2026
• opnsense core REDAXO core before 5.21.5 Missing Authorization in rex_api_package API CVE-2026-116893 6.1 MediumOctober 27, 2026
• redaxo, opnsense core +1 more REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates CVE-2026-63000 Fix available 6.4 MediumSeptember 23, 2026
• opnsense core, redaxo +1 more REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration CVE-2026-62998 Fix available 4.3 MediumSeptember 23, 2026
• redaxo, opnsense core +1 more REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames CVE-2026-63002 Fix available 4.8 MediumSeptember 23, 2026
• redaxo, opnsense core +1 more REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()` CVE-2026-63001 Fix available 4.8 MediumSeptember 23, 2026
• opnsense core Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers CVE-2026-53599 Fix available 7.5 HighJuly 31, 2026
• opnsense core REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter CVE-2026-117538 Fix available 2.1 LowApril 10, 2026
• opnsense core REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter CVE-2026-117537 Fix available 2.1 LowApril 10, 2026