CVE-2026-117538 in REDAXO
Summary
by MITRE • 10/27/2026
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/27/2026
The identified security flaw resides within the REDAXO content management system prior to version 5.21.0 and specifically affects the backend packages API endpoint. This vulnerability is classified as a reflected cross-site scripting issue, which occurs when user-supplied input is included in an error message without proper sanitization or HTML escaping before being rendered back to the browser. The technical root cause lies in the concatenation of function parameters directly into response strings that are subsequently displayed within the web application interface. Because the output context does not apply adequate encoding mechanisms, such as HTML entity encoding, malicious script payloads embedded within these parameters remain executable when processed by the victim's web browser. This lack of input validation and output encoding creates a direct pathway for code injection attacks targeting authenticated users interacting with the administrative panel.
From an operational perspective, this vulnerability poses significant risks to the integrity and confidentiality of the application environment. An attacker can exploit this flaw by crafting a malicious URL that includes specially designed script tags or event handlers within the function parameter fields. By luring an authenticated backend user to visit this crafted link while their session is active, the attacker ensures that the browser will execute the injected JavaScript in the context of the vulnerable site. This execution allows for same-origin actions, meaning the malicious code can interact with the application's DOM as if it were a legitimate part of the page. Consequently, attackers are able to steal sensitive data such as authentication cookies or session tokens, perform unauthorized administrative tasks on behalf of the victim, and potentially deface the backend interface. The requirement for a valid CSRF token in some exploitation scenarios indicates that while basic cross-site request forgery protections exist, they do not mitigate the underlying injection flaw when the payload is delivered via URL parameters rather than form submissions alone.
This vulnerability aligns with Common Weakness Enumeration category CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism reflects input that is immediately returned to the user without validation, fitting the profile of reflected XSS where the payload is not stored on the server but executed during a single request-response cycle. In terms of adversary tactics and techniques, this exploitation method corresponds to ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution within web browsers. The attack vector relies heavily on social engineering or link manipulation to trigger the payload against an authenticated user, leveraging their existing privileges to compromise the system further.
To mitigate this vulnerability and prevent similar issues in future development cycles, it is imperative that all dynamic content rendered in HTML contexts undergoes rigorous encoding processes. Developers should implement strict output encoding strategies using established libraries that handle context-specific escaping for HTML attributes, body text, and JavaScript variables. Additionally, implementing a Content Security Policy header can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby neutralizing many XSS payloads even if they manage to bypass input filters. Upgrading REDAXO to version 5.21.0 or later is the primary remediation step as it addresses these encoding deficiencies within the packages API. Furthermore, enforcing strict validation on all incoming parameters and adopting a whitelist approach for acceptable inputs can significantly reduce the attack surface associated with dynamic parameter handling in administrative interfaces.