Live › vulnerability › CVE-2026-116900
Go to dashboardREDAXO versions before 5.21.4 do not escape values rendered by the media, medialist, link and linklist widgets. A content editor can store crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute and run script in administrators' backend sessions, which can be used to take over accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO before 5.21.4 where content editors can enter values through the media, medialist, link or linklist widgets. The risk is highest where administrators regularly work in the backend while editors have write access to content. Sites on the patched version, or with no non-admin editors, are not exposed through this path.
No product ranges from the sources yet.
redaxo/src/core/boot.php and confirm whether it is below 5.21.45.21.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by storing unescaped values rendered by media, medialist, link and linklist widgets. Attackers can submit crafted REX_INPUT_MEDIA or REX_INPUT_LINK values that break out of the value attribute, executing script in administrators' backend sessions to hijack accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-116900")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.