CVE-2026-116900 in Redaxo
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified within REDAXO versions prior to 5.21.4 represents a critical stored cross-site scripting flaw located specifically within the content management interface's media and link handling widgets. This security defect arises from insufficient input validation and output encoding mechanisms when processing user-supplied data through specific backend components, namely the REX_INPUT_MEDIA and REX_INPUT_LINK fields as well as their associated list variants like medialist and linklist. The core technical failure lies in the application's inability to properly sanitize or escape special characters within these input values before they are rendered back into the HTML structure of the administrative dashboard. Consequently, when a content editor with appropriate privileges submits crafted data containing malicious script payloads embedded within standard media or link attributes, the system stores this unescaped content directly into its database without applying necessary security filters.
From an operational perspective, this vulnerability allows for persistent code execution that persists across user sessions until the stored payload is manually removed from the database. Unlike reflected cross-site scripting which requires tricking a victim into clicking a malicious link, stored XSS leverages the trust users have in the application by embedding the attack within legitimate-looking content entries. When an administrator or another privileged user views the affected page or attempts to edit the compromised entry, the browser interprets the injected HTML and JavaScript as part of the trusted backend interface. This context is particularly dangerous because it operates within the administrative session, granting attackers access to sensitive functionalities that are not available to public-facing users.
The impact of this vulnerability extends beyond simple defacement or cookie theft. By executing scripts in the context of an administrator's session, an attacker can perform actions on behalf of that user with full privileges. This includes modifying site configuration, creating new administrative accounts, deleting content, or accessing sensitive data stored within the CMS database. The ability to break out of value attributes allows for complex injection techniques where attackers can manipulate DOM elements, steal session tokens via document.cookie access, or even perform cross-site request forgery attacks against other parts of the application that rely on authenticated sessions. This effectively compromises the integrity and confidentiality of the entire web platform managed by REDAXO.
This vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as a common cause for cross-site scripting flaws. The attack vector corresponds to ATT&CK technique T1059, specifically sub-techniques involving command and script interpretation through browser-based execution. It also relates to the persistence mechanism described in ATT&CK tactic TA0003, where malicious content is stored within an application's database for later activation. Security researchers note that such flaws are often exacerbated by frameworks or CMS plugins that assume input data will always be safe if it comes from authenticated users who have editing rights, failing to apply the principle of least privilege and defense in depth at the output rendering stage.
Mitigation strategies must prioritize immediate patching to version 5.21.4 or later where these specific encoding issues have been addressed by the development team. In environments where upgrading is not immediately feasible, administrators should implement strict input validation rules that reject any HTML tags or script-like patterns in media and link fields at the point of entry rather than relying solely on output escaping. Additionally, deploying a Web Application Firewall with robust XSS detection capabilities can provide an additional layer of defense by blocking requests containing malicious payloads before they reach the application logic. Enforcing Content Security Policy headers that restrict inline script execution can also mitigate the impact of any successfully injected scripts by preventing them from running in the browser context. Regular security audits and code reviews focusing on data flow between database storage and HTML rendering are essential to prevent similar vulnerabilities in custom modules or third-party extensions integrated into the REDAXO ecosystem.