Security advisory: IBEXA-SA-2026-005

This security advisory concerns four vulnerability fixes released together. These vulnerabilities range from low to critical severity. It is highly urgent that you apply the fixes as soon as possible if you are affected.

DXP vulnerabilities

A critical severity vulnerability in the Rest API can lead to RCE (Remote Code Execution) by users with access to the Rest API. Depending on the installation setup, this may include unauthenticated users. If you can't install the update immediately you should disable external access to the Rest API as a workaround. The issue affects Ibexa DXP 4.6 and 5.0. The update resolves the issue.

A high severity vulnerability in the image download endpoint allows downloading images the user doesn't have read access to. Depending on the installation setup, this may include unauthenticated users. The severity depends on whether your installation has confidential images stored. The issue affects Ibexa DXP 4.6 and 5.0. The update resolves the issue.

Credits

Credit for the discovery of the image download vulnerability goes to the researcher kta1kri. We thank them for responsibly reporting this issue to us.

Third-party vulnerabilities

The CK Editor component is updated to 48.x in Ibexa DXP 5.0. This resolves some security issues in the editor and ensures it will continue to receive active support with feature upgrades. Ibexa DXP 4.6 is not affected by these security issues and will continue to use CK Editor 47.x, which is in maintenance mode.

Flysystem is updated to fix CVE-2026-102601, a vulnerability in its whitespace path normalizer which is ranked by Flysystem as low severity. The issue affects Ibexa DXP 4.6 and 5.0. The update resolves the issue.