CVE-2025-27412: Redaxo CMS XSS Vulnerability

CVE-2025-27412 Overview

CVE-2025-27412 is a reflected cross-site scripting (XSS) vulnerability in REDAXO, a PHP-based content management system. The flaw affects the rex-api-result parameter on the AddOns page. Attackers can inject unsanitized script content into the parameter, which the application reflects back to authenticated users in the administrative interface. Successful exploitation requires user interaction, such as clicking a crafted URL. REDAXO versions 5.0.0 through 5.18.2 are affected, and the maintainers resolved the issue in version 5.18.3. The vulnerability is tracked as [CWE-79]: Improper Neutralization of Input During Web Page Generation.

Critical Impact
An attacker can execute arbitrary JavaScript in an authenticated administrator's browser, enabling session hijacking, credential theft, or unauthorized backend actions within the REDAXO CMS.

Affected Products

REDAXO CMS versions 5.0.0 through 5.18.2
REDAXO AddOns administrative page consuming the rex-api-result parameter
Deployments of REDAXO exposing the backend to untrusted networks

Discovery Timeline

2025-03-05 - CVE-2025-27412 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-27412

Vulnerability Analysis

The vulnerability resides in how REDAXO's AddOns page renders the rex-api-result query parameter. The application reflects the parameter value into HTML output without sufficient encoding or sanitization. An attacker crafts a URL containing malicious JavaScript in rex-api-result and delivers it to a target administrator. When the administrator loads the URL, the browser executes the injected script in the context of the REDAXO backend origin.

Because execution occurs inside an authenticated administrative session, the injected script inherits the privileges of the logged-in user. This includes read and write access to backend APIs, session cookies not marked HttpOnly, and CSRF-protected actions reachable through the browser session. The CVSS vector indicates a scope change, meaning the impact extends beyond the vulnerable component into the user's browser context.

Root Cause

The root cause is missing output encoding on the rex-api-result parameter as it flows from the HTTP request into rendered HTML on the AddOns page. REDAXO did not apply context-appropriate escaping before reflecting the value, allowing attacker-controlled markup to be parsed as active content by the browser.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker constructs a URL targeting a REDAXO backend AddOns page with a JavaScript payload in the rex-api-result parameter. The attacker delivers the URL through phishing, chat, or an external site. When an authenticated administrator visits the link, the payload executes in their session context. No prior authentication or privileges are required of the attacker.

Refer to the REDAXO GitHub Security Advisory GHSA-8366-xmgf-334f for maintainer details.

Detection Methods for CVE-2025-27412

Indicators of Compromise

HTTP requests to REDAXO backend paths containing rex-api-result values that include <script>, javascript:, onerror=, or URL-encoded equivalents such as %3Cscript%3E.
Referer headers pointing to external domains immediately preceding administrator sessions on the AddOns page.
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after backend logins.

Detection Strategies

Inspect web server and reverse proxy access logs for query strings containing suspicious payload fragments in rex-api-result.
Deploy a Web Application Firewall (WAF) rule that flags HTML or JavaScript syntax in rex-api-result values on REDAXO backend URLs.
Correlate authenticated admin sessions with anomalous JavaScript-triggered API calls originating from the same session cookie.

Monitoring Recommendations

Alert on REDAXO backend requests where reflected parameters contain angle brackets, event handler attributes, or encoded script markers.
Monitor administrator accounts for session anomalies such as new IP addresses, changed user-agent strings, or unusual API activity.
Track version banners of REDAXO instances and flag any deployment still running 5.18.2 or earlier.

How to Mitigate CVE-2025-27412

Immediate Actions Required

Upgrade all REDAXO installations to version 5.18.3 or later, which contains the vendor fix.
Restrict access to the REDAXO backend to trusted networks or VPN clients until the upgrade is complete.
Instruct administrators to avoid clicking untrusted links that reference REDAXO backend URLs.

Patch Information

The REDAXO maintainers released version 5.18.3 to resolve CVE-2025-27412. The fix applies proper output encoding to the rex-api-result parameter on the AddOns page. Details are documented in the GitHub Security Advisory GHSA-8366-xmgf-334f.

Workarounds

Enforce a strict Content Security Policy (CSP) on REDAXO backend responses to block inline script execution.
Configure session cookies with HttpOnly and SameSite=Strict attributes to limit script access and cross-site delivery.
Deploy WAF signatures that block reflected XSS patterns in the rex-api-result query parameter on REDAXO backend routes.

bash

# Example nginx WAF-style rule fragment to block XSS payloads in rex-api-result
if ($args ~* "rex-api-result=[^&]*(<|%3C)script") {
    return 403;
}