Live › vulnerability › CVE-2026-117534
Go to dashboardREDAXO before 5.21.3 has a structure/history plugin that accepts unvalidated GET requests, so a crafted link can clear all article snapshots or revert articles to earlier states. An attacker gets to destroy or roll back backend content when a logged-in user opens the link.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO CMS before 5.21.3 with the structure/history plugin enabled and logged-in backend users who can be lured to an external page. Sites without that plugin, or already on 5.21.3 or later, are not affected by this flaw.
No product ranges from the sources yet.
redaxo/src/core/boot.php version constant; a version below 5.21.3 is exposed.5.21.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.
This page as .md · .json · in your agent: get_signal("CVE-2026-117534")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.