Reflected XSS Vulnerability in REDAXO Backend API
CVE-2026-117538

2.1LOW

Key Information:

Vendor

Redaxo

Status
Core
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117538?

The REDAXO platform, prior to version 5.21.0, is susceptible to a reflected cross-site scripting vulnerability in its backend packages API. This vulnerability allows an attacker to craft a malicious link that, when clicked by an authenticated backend user, can execute JavaScript within the same-origin context. Through this exploitation, attackers can manipulate the user's session or access sensitive information from the DOM, presenting significant security risks for REDAXO installations.

Affected Version(s)

core 0 < 5.21.0

core 5.21.0

References

https://github.com/redaxo/core/security/advisories/GHSA-x...
vendor-advisory
https://www.vulncheck.com/advisories/redaxo-before-5.21.0...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

NumberOreo1
.