PatchClock

PHP security digest · Packages

redaxo/source security advisories

4 advisories we have followed since September 2026, newest first. Each page says who is affected, which versions fix it and how to check your project.

  1. Medium 24 Sep 2026

    REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

    Fixed in 5.21.2 · CVE-2026-62998

  2. Medium 23 Sep 2026

    REDAXO: Missing CSRF Protection on Package Update Action Allows Forced Addon Updates

    Fixed in 5.21.2 · CVE-2026-63000

  3. Medium 23 Sep 2026

    REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

    Fixed in 5.21.2 · CVE-2026-63002

  4. Medium 23 Sep 2026

    REDAXO: Stored XSS via Unescaped Media Manager Type Name in `mediaIsInUse()`

    Fixed in 5.21.2 · CVE-2026-63001

Check your project in one command

Composer compares your composer.lock with the public advisory databases:

composer audit

It lists every installed package with a known advisory, including redaxo/source, and the version that fixes it.