Live › vulnerability › CVE-2026-117537
Go to dashboardREDAXO versions before 5.21.0 reflect the type parameter of the metainfo_default_fields_create API without escaping it through rex_view::message(). An attacker who lures a logged-in backend user to a crafted link can run scripts in that victim's backend session.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
REDAXO installations running a version below 5.21.0 are exposed. The attack needs an authenticated backend user to open a crafted link, so exposure is mainly a concern for sites where editors or administrators use the backend. Sites already on or later are not affected.
5.21.0No product ranges from the sources yet.
redaxo/src/core/boot.php and confirm whether it is below 5.21.05.21.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.
This page as .md · .json · in your agent: get_signal("CVE-2026-117537")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.