All vulnerabilities
CVE-2026-117537GHSA-m662-8jrj-cw6v

core: REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter

redaxo corePackagistLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in5.21.0Fixed versionCVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

  • 5.21.0coreCVE List
  • 5.21.0redaxo/source, PackagistOSVcomposer require "redaxo/source:^5.21.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.

Text from CVE List

Affected versions 45

  • coreaffected: all versions before 5.21.0CVE List
  • coreunaffected: 5.21.0CVE List
  • redaxo/source, Packagistfrom first release, fixed in 5.21.0OSV
  • redaxo/source, Packagist5.10.0OSV
  • redaxo/source, Packagist5.10.0-beta1OSV
  • redaxo/source, Packagist5.10.0-beta2OSV
  • redaxo/source, Packagist5.10.1OSV
  • redaxo/source, Packagist5.11.0OSV
  • redaxo/source, Packagist5.11.0-beta1OSV
  • redaxo/source, Packagist5.11.1OSV
  • redaxo/source, Packagist5.11.2OSV
  • redaxo/source, Packagist5.12.0OSV
  • redaxo/source, Packagist5.12.0-beta1OSV
  • redaxo/source, Packagist5.12.0-beta2OSV
  • redaxo/source, Packagist5.12.0-beta3OSV
  • redaxo/source, Packagist5.12.1OSV
  • redaxo/source, Packagist5.13.0OSV
  • redaxo/source, Packagist5.13.0-beta1OSV
  • redaxo/source, Packagist5.13.0-beta2OSV
  • redaxo/source, Packagist5.13.1OSV
  • redaxo/source, Packagist5.13.2OSV
  • redaxo/source, Packagist5.13.3OSV
  • redaxo/source, Packagist5.14.0OSV
  • redaxo/source, Packagist5.14.0-beta1OSV
  • redaxo/source, Packagist5.14.0-beta2OSV
  • redaxo/source, Packagist5.14.1OSV
  • redaxo/source, Packagist5.14.2OSV
  • redaxo/source, Packagist5.14.3OSV
  • redaxo/source, Packagist5.15.0OSV
  • redaxo/source, Packagist5.15.0-beta1OSV
  • redaxo/source, Packagist5.15.1OSV
  • redaxo/source, Packagist5.16.0OSV
  • redaxo/source, Packagist5.16.0-beta1OSV
  • redaxo/source, Packagist5.16.1OSV
  • redaxo/source, Packagist5.17.0OSV
  • redaxo/source, Packagist5.17.1OSV
  • redaxo/source, Packagist5.18.0OSV
  • redaxo/source, Packagist5.18.1OSV
  • redaxo/source, Packagist5.18.2OSV
  • redaxo/source, Packagist5.18.3OSV
  • redaxo/source, Packagist5.19.0OSV
  • redaxo/source, Packagist5.20.0OSV
  • redaxo/source, Packagist5.20.1OSV
  • redaxo/source, Packagist5.20.2OSV
  • redaxo/source, Packagist5.21.0-beta1OSV

References 2