{"id":"CVE-2026-117538","kind":"vulnerability","aliases":["CVE-2026-117538"],"related":[],"title":"REDAXO: reflected XSS in backend packages API lets lured admins run scripts","description":"REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.","summary":"REDAXO versions before 5.21.0 echo the packages API function parameter into an error message without HTML escaping. An attacker who lures a logged-in backend user to a crafted link can run JavaScript in that user's session, acting on the same origin and reading page data.","severity":"medium","cvss":4.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","redaxo","self-hosted"],"not_affected_if":["already-on-5.21.0","no-backend-users"],"how_to_check":"- Check the installed REDAXO version in the backend or in the core `redaxo/src/core/boot.php` version constant; unknown whether the sources give a exact command\n- Flag any install where the version is below `5.21.0`","fix":"- Upgrade REDAXO to `5.21.0` or later\n- unknown whether a workaround exists before upgrading","status":"open","published_at":"2026-10-27T11:17:34+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","triaged_at":"2026-10-27T11:32:20+00:00","updated_at":"2026-10-27T11:32:20+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T11:32:20Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade REDAXO to `5.21.0` or later\n- unknown whether a workaround exists before upgrading","reach":"internet","title":"REDAXO: reflected XSS in backend packages API lets lured admins run scripts","impact":"medium","summary":"REDAXO versions before 5.21.0 echo the packages API function parameter into an error message without HTML escaping. An attacker who lures a logged-in backend user to a crafted link can run JavaScript in that user's session, acting on the same origin and reading page data.","category":"package","nicknames":[],"who_cares":["redaxo","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker runs scripts as a logged-in backend admin, acting on the site","analyst_note":"","how_to_check":"- Check the installed REDAXO version in the backend or in the core `redaxo/src/core/boot.php` version constant; unknown whether the sources give a exact command\n- Flag any install where the version is below `5.21.0`","needs_analyst":false,"not_affected_if":["no-backend-users","already-on-5.21.0"],"who_is_affected":"Sites running REDAXO before 5.21.0 with a backend where users log in, since the attack needs an authenticated backend user to open a crafted link. Public-only sites with no backend users are less exposed. unknown whether any non-default configuration is required.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000594,"input_tokens":3343,"output_tokens":520,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117538':15A,18A '-2026':14A,17A '5.21.0':28B,75C 'act':64B 'action':126C 'admin':10A 'api':7A,32B,88C 'attack':43B,103C 'authent':107C 'backend':5A,50B,86C,108C 'concaten':94C 'contain':76C,114C 'craft':54B,112C 'cross':80C 'cross-sit':79C 'csrf':117C 'cve':13A,16A 'data':72B,130C 'dom':129C 'echo':29B 'error':37B,97C 'escap':41B,102C 'execut':119C 'function':33B,91C 'host':24B 'html':40B,101C 'javascript':58B,120C 'let':8A 'link':55B,113C 'log':48B 'logged-in':47B 'lure':9A,45B,105C 'messag':38B,98C 'origin':68B,125C 'packag':6A,19B,31B,87C 'page':71B 'paramet':34B,92C 'perform':122C 'php':20B 'read':70B,128C 'redaxo':1A,21B,25B,73C 'reflect':2A,78C 'render':99C 'run':11A,57B 'same-origin':123C 'script':12A,82C 'self':23B 'self-host':22B 'session':63B 'site':81C 'token':118C 'user':51B,61B,109C 'valid':116C 'version':26B 'vulner':83C 'without':39B,100C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Sites running REDAXO before 5.21.0 with a backend where users log in, since the attack needs an authenticated backend user to open a crafted link. Public-only sites with no backend users are less exposed. unknown whether any non-default configuration is required.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117538","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117538","severity":null,"published_at":"2026-10-27T11:17:34+00:00","modified_at":"2026-10-27T11:17:34+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","fetched_at":"2026-10-27T11:31:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}