CVE-2026-117534 in Redaxo
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in REDAXO versions prior to 5.21.3 represents a critical cross-site request forgery flaw within the structure/history plugin module. This security defect stems from an insufficient validation of incoming HTTP requests, specifically targeting GET parameters that control administrative functions related to content history management. In secure web application design, state-changing operations such as deleting data or modifying system configurations must be protected against unauthorized initiation by ensuring that requests originate from legitimate user sessions and are explicitly authorized for the intended action. The absence of these safeguards in this specific plugin allows external actors to manipulate authenticated users into performing actions they did not intend, exploiting the trust relationship between the browser and the REDAXO backend interface.
Technically, the flaw manifests through two distinct attack vectors facilitated by unvalidated GET requests. The first vector involves triggering a function labeled func=clearall, which instructs the application to permanently delete all article snapshots stored in the history database. The second vector utilizes the parameter rex_history_function=snap, which forces the system to revert current articles to previously saved states without requiring additional confirmation or CSRF tokens. Because these operations are accessible via simple GET requests, an attacker does not need complex exploit code or user interaction beyond clicking a link or loading an image tag on a malicious page. The browser automatically attaches session cookies and authentication headers when making cross-origin requests, allowing the forged request to be processed as if it were initiated by the logged-in administrator within their own secure context.
The operational impact of this vulnerability is severe due to its potential for data loss and integrity compromise. By exploiting the clearall function, an attacker can erase the entire history log of content changes, effectively removing audit trails that are essential for tracking modifications, debugging issues, or complying with regulatory requirements regarding record retention. This destruction of historical data hinders forensic analysis and obscures malicious activities if they were previously recorded. Furthermore, the ability to roll back articles using the snap function allows an attacker to revert website content to arbitrary previous states. This can be used to deface a site by restoring outdated or compromised versions of pages, disrupt business operations by reverting recent updates, or create confusion among users and administrators regarding the current state of the digital property.
This vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as an attack that forces an end user to execute unwanted actions on a trusted web application. It also maps to MITRE ATT&CK technique T1076, representing Remote File Execution via Web Shell or similar mechanisms where the attacker leverages valid credentials and session tokens to perform administrative tasks remotely. The lack of anti-CSRF tokens in GET requests for sensitive operations is a common misconfiguration that violates OWASP recommendations for state-changing actions. To mitigate this risk, developers must implement robust CSRF protection mechanisms such as synchronizer token patterns or double-submit cookie techniques for all POST, PUT, DELETE, and PATCH requests, while also ensuring that critical administrative functions are not exposed via GET parameters which can be easily forged through standard HTML elements like images or links. Upgrading to REDAXO version 5.21.3 or later is the primary remediation step as it addresses these validation gaps within the structure/history plugin.