Reflected Cross-Site Scripting Vulnerability in REDAXO by Yakamara

CVE-2026-117535

What is CVE-2026-117535?

The REDAXO content management system versions prior to 5.21.3 are affected by a reflected cross-site scripting vulnerability in its backend media pool detail page. This security flaw allows for the 'opener_link' parameter to be rendered without proper HTML escaping. Unauthenticated attackers can exploit this issue by enticing logged-in backend users who have media permissions to click on a specially crafted link. If executed, the injected script can extract the CSRF token, enabling the attacker to perform actions using the victim's session credentials, including executing arbitrary code through template or module modifications, particularly if the victim has administrative privileges.

References