What’s Vulnerable › Vulnerabilities

CVE-2026-62998: REDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column Enumeration

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-09-23 · updated 2026-10-19
• Weakness: CWE-20

Description

REDAXO is a PHP-based content management system. Prior to 5.21.2, rex_list::getSortColumn() in redaxo/src/core/lib/list.php accepts the sort request parameter without checking whether setColumnSortable() registered the requested column. An authenticated backend user can make prepareQuery() add an escaped but unauthorized ORDER BY identifier, allowing error-based enumeration of columns in joined tables and ordering by unselected sensitive fields such as rex_user.password. This issue is fixed in version 5.21.2.

Affected products

• redaxo: before 5.21.2 — fixed in 5.21.2

How to fix

Upgrade to a fixed version: redaxo 5.21.2. Check the vendor advisory for mitigations.

References

• https://github.com/redaxo/core/commit/c44ba5206a28427984100c994010f2aaa6703efd
• https://github.com/redaxo/core/pull/6580
• https://github.com/redaxo/core/releases/tag/5.21.2
• https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58
• https://github.com/redaxo/core/security/advisories/GHSA-4f5f-j737-pm58

Get alerted when CVE-2026-62998 or the next vulnerability affects your stack