DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63000: CVE-2026-63000: Cross-Site Request Forgery in REDAXO CMS Package Update API

#security #cve #cybersecurity

CVE-2026-63000: Cross-Site Request Forgery in REDAXO CMS Package Update API

Vulnerability ID: CVE-2026-63000
CVSS Score: 6.4
Published: 2026-09-23

A Cross-Site Request Forgery (CSRF) vulnerability in REDAXO CMS prior to version 5.21.2 allows unauthenticated remote attackers to trigger unauthorized package updates by exploiting an insecure default configuration in the base API class.

TL;DR

Unprotected API handler allows attackers to force authenticated administrators to perform unauthorized package updates via CSRF.

Technical Details

  • CWE ID: CWE-352
  • Attack Vector: Network
  • CVSS: 6.4 (Medium)
  • EPSS Status: None (recent 2026 listing)
  • Impact: Integrity Modification, Unauthorized Package Deployment
  • Exploit Status: None
  • KEV Status: Not Listed

Affected Systems

  • REDAXO CMS
  • core: < 5.21.2 (Fixed in: 5.21.2)

Code Analysis

Commit: a13abbf

Fix: Add missing requiresCsrfProtection override to rex_api_install_package_update

Mitigation Strategies

  • Upgrade REDAXO CMS to version 5.21.2 or higher to resolve the insecure inheritance flaw.
  • Apply manual patch to the api_package_update.php file if immediate system upgrades are not possible.
  • Incorporate strict network routing or administrative session management controls to minimize exposure window.

Remediation Steps:

  1. Navigate to the root directory of the REDAXO CMS installation.
  2. Download the updated package or pull the latest changes from the release tag 5.21.2.
  3. If patching manually, open the file redaxo/src/addons/install/lib/api/api_package_update.php.
  4. Add the requiresCsrfProtection method with a return value of true directly into the class scope.
  5. Test endpoint functionality by attempting to call the update handler without a valid CSRF token parameter to confirm that the API router rejects the request.

References

Read the full report for CVE-2026-63000 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)