---
id: "CVE-2026-117538"
kind: "vulnerability"
aliases: ["CVE-2026-117538"]
title: "REDAXO: reflected XSS in backend packages API lets lured admins run scripts"
severity: "medium"
cvss: 4.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "php", "redaxo", "self-hosted"]
not_affected_if: ["already-on-5.21.0", "no-backend-users"]
published_at: "2026-10-27T11:17:34+00:00"
first_seen_at: "2026-10-27T11:31:28+00:00"
updated_at: "2026-10-27T11:32:20+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117538", "first_seen_at": "2026-10-27T11:31:28+00:00"}]
---

# REDAXO: reflected XSS in backend packages API lets lured admins run scripts

REDAXO versions before 5.21.0 echo the packages API function parameter into an error message without HTML escaping. An attacker who lures a logged-in backend user to a crafted link can run JavaScript in that user's session, acting on the same origin and reading page data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO version in the backend or in the core `redaxo/src/core/boot.php` version constant; unknown whether the sources give a exact command
- Flag any install where the version is below `5.21.0`

## Fix

- Upgrade REDAXO to `5.21.0` or later
- unknown whether a workaround exists before upgrading

## Timeline

- 2026-10-27T11:31:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117538

## From the sources

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_