---
id: "CVE-2026-116895"
kind: "vulnerability"
aliases: ["CVE-2026-116895"]
title: "REDAXO: backend accepts forged safemode link, disabling safe mode via CSRF"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "redaxo", "self-hosted"]
not_affected_if: ["no-backend-admin-logins", "version-5.21.5-or-later"]
published_at: "2026-10-27T11:17:32+00:00"
first_seen_at: "2026-10-27T11:31:27+00:00"
updated_at: "2026-10-27T11:32:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116895", "first_seen_at": "2026-10-27T11:31:27+00:00"}]
---

# REDAXO: backend accepts forged safemode link, disabling safe mode via CSRF

REDAXO's backend reads a safemode GET parameter in index.php without checking a CSRF token. A crafted link can make a logged-in administrator turn off global safe mode or disable backend addons.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO version in the backend or `redaxo/src/core/version.php`; affected versions are before `5.21.5`.
- Look for `safe_mode: false` in `redaxo/src/core/config.yml` if the instance has been reachable by a logged-in admin following external links.

## Fix

- Upgrade REDAXO to `5.21.5` or later.
- Until upgraded, avoid following untrusted links while logged into the backend.

## Timeline

- 2026-10-27T11:31:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116895

## From the sources

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_