CVE-2025-66026·PHP vulnerability

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 0.23% — higher than 14% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

How to fix this CVE

REDAXO CMS users must upgrade to version 5.20.1 or later to patch a reflected XSS vulnerability in the Mediapool component. The vulnerability allows authenticated attackers to inject malicious scripts through a crafted URL parameter that bypasses HTML encoding. Ensure all backend users are notified to upgrade immediately and avoid clicking untrusted links while logged into the REDAXO admin panel.

sudo dnf update php

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

GET|POST request to admin interface with parameter pattern `args\[types\]=[^&]*<script|args\[types\]=[^&]*javascript:|args\[types\]=[^&]*onerror=|args\[types\]=[^&]*onload=` targeting /index.php?page=mediapool or similar Mediapool paths

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch.

Block or sanitize requests containing unescaped HTML/JavaScript in the args[types] query parameter by implementing input validation rules that reject angle brackets, event handlers (onerror, onload, onclick), and script tags in this parameter. Apply strict output encoding for any data reflected in admin panel info banners.

How to check if you are affected

1. Step 1: Check REDAXO version with `grep -r "version" /path/to/redaxo/redaxo/src/core/boot.php | grep -oP '\d+\.\d+\.\d+'` or verify in admin dashboard under System → About
2. Step 2: Search for the Mediapool module accessibility by reviewing /redaxo/src/addons/mediapool/ directory permissions and admin user access logs
3. Step 3: Check web server logs (Apache/Nginx) for GET/POST requests containing `args[types]=` parameter in URLs targeting `/index.php?page=mediapool` or similar admin paths
4. Step 4: Verify REDAXO version is 5.20.1 or higher by running `grep -r '5\.20\.[1-9]' /path/to/redaxo/` or checking the official GitHub releases page

FAQ

Related PHP CVEs

References

• https://github.com/redaxo/redaxo/commit/58929062312cf03e344ab04067a365e6b6ee66aa
• https://github.com/redaxo/redaxo/security/advisories/GHSA-x6vr-q3vf-vqgq
• https://github.com/redaxo/redaxo/security/advisories/GHSA-x6vr-q3vf-vqgq