{"schema":"threatline.record/2","record":{"id":"CVE-2026-117538","aliases":["GHSA-xq4j-g85q-wf97"],"summary":"REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter","details":"REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.","categories":["Libraries & packages"],"product":"core","vendor":"redaxo","ecosystem":"Packagist","affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117538","source_modified_at":"2026-10-27T10:59:32.772Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"core","vendor":"redaxo","versions":[{"version":"0","status":"affected","versionType":"semver","lessThan":"5.21.0"},{"version":"5.21.0","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xq4j-g85q-wf97","source_modified_at":"2026-04-10T19:49:39.034910Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"redaxo/source","ecosystem":"Packagist","purl":"pkg:composer/redaxo/source"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.21.0"}]}],"versions":["5.10.0","5.10.0-beta1","5.10.0-beta2","5.10.1","5.11.0","5.11.0-beta1","5.11.1","5.11.2","5.12.0","5.12.0-beta1","5.12.0-beta2","5.12.0-beta3","5.12.1","5.13.0","5.13.0-beta1","5.13.0-beta2","5.13.1","5.13.2","5.13.3","5.14.0","5.14.0-beta1","5.14.0-beta2","5.14.1","5.14.2","5.14.3","5.15.0","5.15.0-beta1","5.15.1","5.16.0","5.16.0-beta1","5.16.1","5.17.0","5.17.1","5.18.0","5.18.1","5.18.2","5.18.3","5.19.0","5.20.0","5.20.1","5.20.2","5.21.0-beta1"]}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117538","source_modified_at":"2026-10-27T10:59:32.772Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"core","ecosystem":null},"version":"5.21.0","basis":"first unaffected version stated in the CVE record"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-xq4j-g85q-wf97","source_modified_at":"2026-04-10T19:49:39.034910Z","fetched_at":"2026-10-27T16:27:21.584480Z","package":{"name":"redaxo/source","ecosystem":"Packagist","purl":"pkg:composer/redaxo/source"},"version":"5.21.0"}],"cvss":2.1,"severity":"Low","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T10:59:32.772Z","modified_at":"2026-10-27T10:59:32.772Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117538","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T10:59:32.772Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-xq4j-g85q-wf97","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-04-10T19:49:39.034910Z"}],"sources":["CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/redaxo/core/security/advisories/GHSA-xq4j-g85q-wf97","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/redaxo-before-5.21.0-reflected-xss-via-packages-api-function-parameter","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-27T10:59:32.772Z","content_hash":"3a02ae32ca19c5728585d9393cc85344b5fbc5a133ade556e0c1bcda5dac4b51"}}