CVE-2026-117535 in Redaxo
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in REDAXO versions prior to 5.21.3 represents a critical security flaw within the backend media pool interface, specifically affecting the detail page functionality. This issue manifests as a reflected cross-site scripting (XSS) vector triggered by improper handling of the opener_link parameter. In standard web application architecture, user-supplied input must be rigorously sanitized and encoded before being rendered in an HTML context to prevent the execution of malicious scripts. However, in this specific implementation, the opener_link value is inserted directly into the page output without adequate HTML escaping or validation. This failure allows attackers to inject arbitrary JavaScript code that will execute within the browser session of any user who views the manipulated content. The vulnerability is classified under CWE-79, which covers Improper Neutralization of Input During Web Page Generation, commonly known as Cross-site Scripting (XSS).
The operational impact of this flaw is severe due to its potential for privilege escalation and unauthorized code execution. Although the initial vector requires social engineering—specifically luring a logged-in backend user with media permissions into clicking a crafted link—the consequences extend far beyond simple script injection. Once the malicious script executes in the victim's browser, it operates within the context of that authenticated session. This allows the attacker to access sensitive data stored locally or transmitted during active sessions, most notably the CSRF tokens used by REDAXO to prevent cross-site request forgery attacks. By stealing these tokens, an attacker can bypass standard anti-CSRF protections and forge requests on behalf of the victim user.
The severity escalates significantly when the target is a backend administrator with elevated privileges. If such a user interacts with the crafted link, the injected script gains the ability to perform actions that require administrative rights. This includes editing templates or modules within the REDAXO system. Since these components often allow for server-side code execution through template syntax or module configurations, an attacker can effectively achieve remote code execution on the underlying web server. This transforms a client-side scripting vulnerability into a full compromise of the backend infrastructure, potentially leading to data exfiltration, defacement, or further lateral movement within the network environment. From a threat modeling perspective, this aligns with MITRE ATT&CK techniques related to Client-Side Scripting Injection and Credential Access via Browser Session Hijacking.
To mitigate this vulnerability, organizations running REDAXO must immediately upgrade to version 5.21.3 or later, where the issue has been resolved through proper input encoding practices. For systems that cannot be patched instantly due to operational constraints, temporary mitigations should focus on restricting access to the backend media pool detail pages using strong authentication mechanisms and network-level controls such as IP whitelisting for administrative interfaces. Additionally, implementing a strict Content Security Policy (CSP) can help mitigate the impact of any successful XSS attempts by preventing the execution of unauthorized scripts. Regular security audits and code reviews focusing on input validation in all backend-facing parameters are essential to prevent similar flaws from being introduced or remaining undetected in future updates.