REDAXO core versions earlier than 5.21.3 contain a reflected cross‑site scripting flaw in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. An attacker can craft a malicious link that, when clicked by a logged‑in backend user with media permissions, injects JavaScript that can read the victim's CSRF token and perform actions on the site using the victim's permissions, including code execution through template or module edits if the victim is an administrator. The vulnerability therefore enables attackers to hijack the session of legitimate users and execute arbitrary code with the privileges of the target account.

Any installation of REDAXO core built before the 5.21.3 release is vulnerable. The flaw originates from the media pool detail page, so systems that use the media management interface and have backend users with media permissions are at risk. The affected component is the REDAXO core package, specifically all versions older than 5.21.3.

The CVSS score of 5.1 indicates a moderate impact, and the EPSS score is currently unavailable, suggesting limited publicly known exploitation traffic. REDAXO is not listed in the CISA KEV catalog, but the potential to obtain code execution through an administrator account makes the flaw attractive to targeted attackers. Exploitation requires an unauthenticated attacker to entice a legitimate backend user into clicking a crafted link, meaning the attack vector involves user interaction and social engineering rather than a purely automated exploitation path.