CVE-2026-117537: REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

Severity: medium (CVSS 4.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-27 · updated 2026-10-27
Weakness: CWE-79

Description

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.

Affected products

redaxo core: before 5.21.0 — fixed in 5.21.0

How to fix

Upgrade to a fixed version: redaxo core 5.21.0. Check the vendor advisory for mitigations.

References

https://github.com/redaxo/core/security/advisories/GHSA-m662-8jrj-cw6v
https://www.vulncheck.com/advisories/redaxo-before-5.21.0-reflected-xss-via-metainfo-api-type-parameter

Get alerted when CVE-2026-117537 or the next vulnerability affects your stack