CVE-2026-117538: REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

Severity: medium (CVSS 4.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-27 · updated 2026-10-27
Weakness: CWE-79

Description

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.

Affected products

redaxo core: before 5.21.0 — fixed in 5.21.0

How to fix

Upgrade to a fixed version: redaxo core 5.21.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-117538 or the next vulnerability affects your stack