CVE-2026-116895: REDAXO before 5.21.5 CSRF via Safe Mode Toggle Parameter
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safemode: false to config.yml, or enable session safe mode, disabling backend addons.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
REDAXOto a version that resolves this vulnerability.Fixed in 5.21.5
Event History
Frequently Asked Questions
Who is exposed to this issue?
REDAXO installations before 5.21.5 are exposed when a backend administrator is logged in and can be induced to open an attacker-crafted link.
What does an attacker need to exploit it?
The attacker does not need authentication, but exploitation requires user interaction from a logged-in administrator opening the crafted link. The vulnerable request is handled through the safemode GET parameter in index.php without CSRF-token validation.
What changes can the attack cause?
An attacker can disable global safe mode, causing safe_mode: false to be written to config.yml. They can also enable session safe mode, which disables backend addons.