Live › vulnerability › CVE-2026-116895
Go to dashboardREDAXO's backend reads a safemode GET parameter in index.php without checking a CSRF token. A crafted link can make a logged-in administrator turn off global safe mode or disable backend addons.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Any REDAXO installation before 5.21.5 with a backend that administrators log into. The attack needs a logged-in administrator to open a crafted link, so instances without active admin sessions face less risk.
No product ranges from the sources yet.
redaxo/src/core/version.php; affected versions are before 5.21.5.safe_mode: false in redaxo/src/core/config.yml if the instance has been reachable by a logged-in admin following external links.5.21.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.
This page as .md · .json · in your agent: get_signal("CVE-2026-116895")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.