CVE-2026-117537 in Redaxo
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The vulnerability identified in REDAXO versions prior to 5.21.0 represents a significant security flaw within the application's content management API layer, specifically affecting the metainfo_default_fields_create endpoint. This component is responsible for creating default fields for meta information structures, which are essential for extending database schemas with custom data types. The core technical issue lies in how the system handles user-supplied input passed through the type parameter of this specific API call. Instead of properly sanitizing or encoding the input before rendering it back to the client interface, the application passes the value directly into a view layer function known as rex_view::message(). This function is designed to display status messages to users but fails to apply necessary output encoding mechanisms such as HTML entity escaping when processing data derived from API parameters. Consequently, any special characters or script tags included in the type parameter are preserved and rendered by the browser without modification, creating a classic reflected cross-site scripting scenario where malicious code can be injected into the page context during the request-response cycle.
From an operational perspective, this vulnerability allows authenticated attackers to execute arbitrary JavaScript within the backend session of any user who interacts with a crafted link or API call containing the malicious payload. The requirement for authentication and a valid CSRF token indicates that while the attack surface is somewhat restricted compared to unauthenticated vulnerabilities, it remains highly dangerous because it targets privileged administrative interfaces. An attacker could craft a URL where the type parameter contains a script tag designed to exfiltrate session cookies, perform actions on behalf of the victim such as creating new admin users or modifying site configurations, or redirect the user to phishing sites. Since the payload is reflected via the message function, the execution occurs immediately upon rendering the response page in the browser environment where the authenticated session token resides. This enables persistent access if the attacker steals credentials or facilitates lateral movement within the administrative interface by manipulating backend states through automated scripts running under the victim's authority.
The classification of this flaw aligns with CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under reflected XSS because the malicious script is not stored in a database but rather returned immediately by the application in response to a single request. In terms of offensive security frameworks like MITRE ATT&CK, this vulnerability facilitates techniques associated with Collection via Browser Redirect or Credential Access through Stealing Web Session Cookies if the crafted payload includes data exfiltration logic. The presence of CSRF token validation suggests that the developers were aware of cross-site request forgery risks but overlooked the complementary risk of input validation and output encoding within the API response handling pipeline. This oversight highlights a common gap in web application security where backend APIs are treated as trusted sources for internal processing, yet their outputs remain exposed to client-side interpretation without adequate sanitization checks.
To mitigate this vulnerability, immediate patching is required by upgrading REDAXO to version 5.21.0 or later, which addresses the encoding logic within the rex_view::message function and related API endpoints. For organizations unable to upgrade immediately due to compatibility constraints, implementing a Web Application Firewall rule can provide temporary protection by detecting and blocking requests containing script tags or encoded variants of HTML entities in the type parameter of metainfo_default_fields_create calls. Additionally, developers should enforce strict input validation on all API parameters regardless of their intended use case, ensuring that only expected data types are accepted. On the output side, implementing context-aware encoding is critical; since the message function renders content into an HTML page body or attribute context, applying htmlspecialchars with appropriate flags such as ENT_QUOTES and specifying UTF-8 character set will neutralize script execution vectors. Regular security audits focusing on API response handling and integration testing for XSS payloads in all user-controllable parameters are recommended to prevent similar flaws from persisting in future releases.