CVE-2026-117538: REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
REDAXO installations running versions before 5.21.0 are affected when an authenticated backend user can be induced to open a crafted link. The vulnerable path is the backend packages API.
What does an attacker need to exploit it?
An attacker needs to lure an authenticated backend user to a crafted URL that includes a valid CSRF token. Exploitation relies on the malicious value supplied through the API function parameter being reflected into an unescaped error message.
What could successful exploitation allow?
JavaScript executes in the authenticated backend user's browser and origin context. This can allow same-origin actions and reading of DOM data available to that user.
How can this be remediated?
Upgrade REDAXO to version 5.21.0 or later. The affected versions are those before 5.21.0.