{"id":"CVE-2026-117537","kind":"vulnerability","aliases":["CVE-2026-117537"],"related":[],"title":"REDAXO: reflected XSS in metainfo API runs scripts in admin sessions","description":"REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.","summary":"REDAXO versions before 5.21.0 reflect the type parameter of the metainfo_default_fields_create API without escaping it through rex_view::message(). An attacker who lures a logged-in backend user to a crafted link can run scripts in that victim's backend session.","severity":"medium","cvss":4.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["php","redaxo","runtime","self-hosted"],"not_affected_if":["version-5.21.0-or-later"],"how_to_check":"- Check the installed REDAXO version in the core package or `redaxo/src/core/boot.php` and confirm whether it is below `5.21.0`\n- Confirm whether the backend is reachable by users who could be lured to a crafted link","fix":"- Upgrade REDAXO to `5.21.0` or later\n- Unknown whether a workaround exists before upgrading","status":"open","published_at":"2026-10-27T11:17:34+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","triaged_at":"2026-10-27T11:32:23+00:00","updated_at":"2026-10-27T11:32:23+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-10-27T11:32:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade REDAXO to `5.21.0` or later\n- Unknown whether a workaround exists before upgrading","reach":"internet","title":"REDAXO: reflected XSS in metainfo API runs scripts in admin sessions","impact":"medium","summary":"REDAXO versions before 5.21.0 reflect the type parameter of the metainfo_default_fields_create API without escaping it through rex_view::message(). An attacker who lures a logged-in backend user to a crafted link can run scripts in that victim's backend session.","category":"runtime","nicknames":[],"who_cares":["redaxo","php","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"script runs in a logged-in backend admin's session","analyst_note":"","how_to_check":"- Check the installed REDAXO version in the core package or `redaxo/src/core/boot.php` and confirm whether it is below `5.21.0`\n- Confirm whether the backend is reachable by users who could be lured to a crafted link","needs_analyst":false,"not_affected_if":["version-5.21.0-or-later"],"who_is_affected":"REDAXO installations running a version below `5.21.0` are exposed. The attack needs an authenticated backend user to open a crafted link, so exposure is mainly a concern for sites where editors or administrators use the backend. Sites already on `5.21.0` or later are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000595,"input_tokens":3344,"output_tokens":522,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117537':14A,17A '-2026':13A,16A '5.21.0':27B,71C 'admin':10A 'allow':81C 'api':6A,38B,97C 'attack':47B,83C,98C 'authent':82C 'backend':54B,67B,123C 'contain':72C 'craft':58B,100C 'creat':37B,96C 'cross':76C 'cross-sit':75C 'csrf':106C 'cve':12A,15A 'default':35B,94C 'escap':40B 'execut':117C 'field':36B,95C 'host':23B 'html':109C 'inject':85C 'link':59B,102C 'log':52B 'logged-in':51B 'lure':49B 'messag':45B,114C 'metainfo':5A,34B,93C 'paramet':31B,90C 'payload':110C 'php':18B 'redaxo':1A,19B,24B,69C 'reflect':2A,28B,74C 'render':115C 'rex':43B,112C 'run':7A,61B 'runtim':20B 'script':8A,62B,78C,86C,118C 'self':22B 'self-host':21B 'session':11A,68B,124C 'site':77C 'token':107C 'type':30B,89C 'unescap':116C 'user':55B 'valid':105C 'version':25B 'via':87C 'victim':65B,121C 'view':44B,113C 'vulner':79C 'without':39B 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"REDAXO installations running a version below `5.21.0` are exposed. The attack needs an authenticated backend user to open a crafted link, so exposure is mainly a concern for sites where editors or administrators use the backend. Sites already on `5.21.0` or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117537","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117537","severity":null,"published_at":"2026-10-27T11:17:34+00:00","modified_at":"2026-10-27T11:17:34+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","fetched_at":"2026-10-27T11:31:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}