Reflected Cross-Site Scripting in REDAXO by the Vendor REDAXO
CVE-2026-117537

2.1LOW

Key Information:

Vendor

Redaxo

Status
Core
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117537?

REDAXO versions prior to 5.21.0 are susceptible to a reflected cross-site scripting vulnerability. This issue allows authenticated attackers to exploit the metainfo_default_fields_create API by injecting malicious scripts through the 'type' parameter. By crafting a specially designed link that includes a valid CSRF token and an HTML payload, attackers can manipulate the response rendered by rex_view::message(), leading to the execution of scripts within a victim's backend session. This significantly raises the risk of unauthorized actions and data exposure within the REDAXO platform.

Affected Version(s)

core 0 < 5.21.0

core 5.21.0

References

https://github.com/redaxo/core/security/advisories/GHSA-m...
vendor-advisory
https://www.vulncheck.com/advisories/redaxo-before-5.21.0...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NumberOreo1
.