{"schema":"threatline.record/2","record":{"id":"CVE-2026-117537","aliases":["GHSA-m662-8jrj-cw6v"],"summary":"REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter","details":"REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.","categories":["Libraries & packages"],"product":"core","vendor":"redaxo","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117537","source_modified_at":"2026-10-27T14:12:21.902Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"core","vendor":"redaxo","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"5.21.0"},{"version":"5.21.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m662-8jrj-cw6v","source_modified_at":"2026-04-10T19:49:11.559366Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"redaxo/source","ecosystem":"Packagist","purl":"pkg:composer/redaxo/source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.0"}]}],"versions":["5.10.0","5.10.0-beta1","5.10.0-beta2","5.10.1","5.11.0","5.11.0-beta1","5.11.1","5.11.2","5.12.0","5.12.0-beta1","5.12.0-beta2","5.12.0-beta3","5.12.1","5.13.0","5.13.0-beta1","5.13.0-beta2","5.13.1","5.13.2","5.13.3","5.14.0","5.14.0-beta1","5.14.0-beta2","5.14.1","5.14.2","5.14.3","5.15.0","5.15.0-beta1","5.15.1","5.16.0","5.16.0-beta1","5.16.1","5.17.0","5.17.1","5.18.0","5.18.1","5.18.2","5.18.3","5.19.0","5.20.0","5.20.1","5.20.2","5.21.0-beta1"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117537","source_modified_at":"2026-10-27T14:12:21.902Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"core","ecosystem":null},"version":"5.21.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-m662-8jrj-cw6v","source_modified_at":"2026-04-10T19:49:11.559366Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"redaxo/source","ecosystem":"Packagist","purl":"pkg:composer/redaxo/source"},"version":"5.21.0"}],"cvss":2.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T10:59:32.121Z","modified_at":"2026-10-27T14:12:21.902Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117537","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T14:12:21.902Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-m662-8jrj-cw6v","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-04-10T19:49:11.559366Z"}],"sources":["CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/redaxo/core/security/advisories/GHSA-m662-8jrj-cw6v","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/redaxo-before-5.21.0-reflected-xss-via-metainfo-api-type-parameter","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-10-27T13:42:34.335410Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T14:12:21.902Z","content_hash":"de1db90a9af153be413ba18dce0fbbb98057431b947d193daedb9a124c6dad7e"}}