CVE-2026-117534: REDAXO before 5.21.3 CSRF in Article History Plugin
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rexhistoryfunction=snap, permanently deleting all article snapshots or reverting articles to earlier states.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
REDAXO installations before 5.21.3 are exposed when a user is logged in to the backend and can be induced to visit an attacker-controlled page or link.
What must an attacker do to exploit it?
The attacker does not need authentication, but must lure a logged-in backend user into triggering an unvalidated GET request. The request can invoke func=clearall to delete article snapshots or rex_history_function=snap to roll an article back to an earlier state.
What is the impact if exploitation succeeds?
An attacker can permanently delete all article history snapshots or revert articles to previous versions. The described impact affects content integrity and availability, not confidentiality.
How can I tell whether my installation is affected?
Check whether the REDAXO version is earlier than 5.21.3 and whether the structure/history plugin is present. Affected behavior includes state-changing history actions being accepted through GET requests using the named parameters.