CVE-2026-117537: REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfodefaultfieldscreate API. Attackers can craft a link with a valid CSRF token and HTML payload that rexview::message() renders unescaped, executing scripts in a victim's backend session.
Event History
Frequently Asked Questions
Who can exploit this issue?
Exploitation requires an authenticated attacker with high privileges and a valid CSRF token. The attacker must be able to craft a request or link targeting the metainfo_default_fields_create API.
What is required for the payload to execute?
A victim must load the crafted request in a REDAXO backend session. The injected HTML payload in the type parameter is rendered unescaped by rex_view::message(), causing script execution in that backend session.
Which deployments are affected?
REDAXO versions before 5.21.0 are affected. The provided information does not identify configuration-specific prerequisites beyond access to the affected API and backend session context.