Skip to content

REDAXO

v5.21.2 Security

This release includes 5 security fixes for security teams reviewing exposed deployments.

Published 28d Productivity & Wikis
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 5 known CVEs

Topics

cms php redaxo simple

Affected surfaces

auth rce_ssrf

Summary

AI summary

Updates Bugfixes, @gharlan, and @tbaddade across a mixed release.

Full changelog

REDAXO-Core 5.21.2 – 29.06.2026

Security

  • rex_list: Sortier-Spalte wurde nicht validiert gegen die aktivierten sortierbaren Spalten (gemeldet von @de3erve-hunter) (@de3erve-hunter, @gharlan)

Bugfixes

  • JS: scrollToAnchor robuster bzgl. später Layout-Shifts (@aeberhard, @gharlan)
  • rex_sql_table: Unterschied zwischen ensure und alter klarer gemacht in PHPDocs (@gharlan)

be_style 3.8.1 – 29.06.2026

  • SCSS: Nutzung Parent-Selector & in Dart-Sass-kompatibler Version (@tbaddade)
  • Button-Styling korrigiert (@tbaddade)

install 2.14.1 – 29.06.2026

Security

  • CSRF-Schutz für Addon-Update-ApiFunction fehlte (gemeldet von @de3erve-hunter) (@gharlan)

media_manager 2.18.2 – 29.06.2026

Security

  • Stored XSS via Type-Name in mediaIsInUse (gemeldet von @de3erve) (@gharlan)

mediapool 2.18.2 – 29.06.2026

Security

  • Stored XSS via Artikelname in mediaIsInUse und Dateinamen in Sync-Page (gemeldet von @de3erve-hunter) (@gharlan)

metainfo 2.12.2 – 29.06.2026

Security

  • Stored XSS via isMediaInUse (@gharlan)

phpmailer 2.17.2 – 29.06.2026

Security

  • XSS via Debug/Error-Ausgabe (@gharlan)

Security Fixes

  • Stored XSS via Type-Name in mediaIsInUse (media_manager)
  • Stored XSS via Artikelname in mediaIsInUse and Dateinamen in Sync-Page (mediapool)
  • Stored XSS via isMediaInUse (metainfo)
  • XSS via Debug/Error‑Ausgabe (phpmailer)
  • CSRF protection missing for Addon‑Update ApiFunction (install)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track REDAXO

Get notified when new releases ship.

Sign up free

About REDAXO

Simple, flexible and useful content management system (documentation in German).

All releases →

Related context

Beta — feedback welcome: [email protected]