https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 16:03:29 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63000 <p>REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator&#39;s browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator&#39;s intent. This issue is fixed in version 5.21.2.</p> <p>REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_api_install_package_update in redaxo/src/addons/install/lib/api/api_package_update.php inherits the false default from rex_api_function::requiresCsrfProtection() instead of requiring a CSRF token. An unauthenticated attacker can cause a logged-in administrator&#39;s browser to request a selected package update from the configured REDAXO package server, changing installed addon code or disrupting the site without the administrator&#39;s intent. This issue is fixed in version 5.21.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63000 https://vulnerability.circl.lu/vuln/ghsa-m8r3-22v6-g877 <p><strong>Affected:</strong> Packagist: redaxo/source</p> <p>### Summary The `rex_api_install_package_update` API function (`install` addon) does not override `requiresCsrfProtection()`, which defaults to `false` in the base class `rex_api_function`. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.</p> <p>### Details **File:** `redaxo/src/core/lib/api_function.php:277-280` ```php protected function requiresCsrfProtection() { return false; // DEFAULT — subclasses must opt in } ```</p> <p>**File:** `redaxo/src/addons/install/lib/api/api_package_update.php:8-39` ```php class rex_api_install_package_update extends rex_api_function { public function execute() { if (!rex::getUser()?-&gt;isAdmin()) { throw new rex_api_exception(&#39;You do not have the permission!&#39;); } $addonkey = rex_request(&#39;addonkey&#39;, &#39;string&#39;); $fileId = rex_request(&#39;file&#39;, &#39;int&#39;); $installer = new rex_install_package_update(); // ... downloads and installs $addonkey version $fileId from redaxo.org } // requiresCsrfProtection() NOT overridden — defaults to false } ```</p> <p>For comparison, `rex_api_install_package_add` and `rex_api_install_package_delete` both correctly return `true`. Only `rex_api_install_package_update` is missing this.</p> <p>### PoC ```html &lt;!-- Attacker-controlled page --&gt; &lt;img src=&#34;https://victim-redaxo.example.com/index.php?page=install/packages&amp;rex-api-call=install_package_update&amp;addonkey=some_addon&amp;file=4…</p> <p><strong>Affected:</strong> Packagist: redaxo/source</p> <p>### Summary The `rex_api_install_package_update` API function (`install` addon) does not override `requiresCsrfProtection()`, which defaults to `false` in the base class `rex_api_function`. Any authenticated admin can therefore be tricked via a CSRF attack into silently triggering a package update from the REDAXO package server.</p> <p>### Details **File:** `redaxo/src/core/lib/api_function.php:277-280` ```php protected function requiresCsrfProtection() { return false; // DEFAULT — subclasses must opt in } ```</p> <p>**File:** `redaxo/src/addons/install/lib/api/api_package_update.php:8-39` ```php class rex_api_install_package_update extends rex_api_function { public function execute() { if (!rex::getUser()?-&gt;isAdmin()) { throw new rex_api_exception(&#39;You do not have the permission!&#39;); } $addonkey = rex_request(&#39;addonkey&#39;, &#39;string&#39;); $fileId = rex_request(&#39;file&#39;, &#39;int&#39;); $installer = new rex_install_package_update(); // ... downloads and installs $addonkey version $fileId from redaxo.org } // requiresCsrfProtection() NOT overridden — defaults to false } ```</p> <p>For comparison, `rex_api_install_package_add` and `rex_api_install_package_delete` both correctly return `true`. Only `rex_api_install_package_update` is missing this.</p> <p>### PoC ```html &lt;!-- Attacker-controlled page --&gt; &lt;img src=&#34;https://victim-redaxo.example.com/index.php?page=install/packages&amp;rex-api-call=install_package_update&amp;addonkey=some_addon&amp;file=4…</p> https://vulnerability.circl.lu/vuln/ghsa-m8r3-22v6-g877