All vulnerabilities
CVE-2026-117538GHSA-xq4j-g85q-wf97

core: REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter

redaxo corePackagistLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.1Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in5.21.0Fixed versionCVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

  • 5.21.0coreCVE List
  • 5.21.0redaxo/source, PackagistOSVcomposer require "redaxo/source:^5.21.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.

Text from CVE List

Affected versions 45

  • coreaffected: all versions before 5.21.0CVE List
  • coreunaffected: 5.21.0CVE List
  • redaxo/source, Packagistfrom first release, fixed in 5.21.0OSV
  • redaxo/source, Packagist5.10.0OSV
  • redaxo/source, Packagist5.10.0-beta1OSV
  • redaxo/source, Packagist5.10.0-beta2OSV
  • redaxo/source, Packagist5.10.1OSV
  • redaxo/source, Packagist5.11.0OSV
  • redaxo/source, Packagist5.11.0-beta1OSV
  • redaxo/source, Packagist5.11.1OSV
  • redaxo/source, Packagist5.11.2OSV
  • redaxo/source, Packagist5.12.0OSV
  • redaxo/source, Packagist5.12.0-beta1OSV
  • redaxo/source, Packagist5.12.0-beta2OSV
  • redaxo/source, Packagist5.12.0-beta3OSV
  • redaxo/source, Packagist5.12.1OSV
  • redaxo/source, Packagist5.13.0OSV
  • redaxo/source, Packagist5.13.0-beta1OSV
  • redaxo/source, Packagist5.13.0-beta2OSV
  • redaxo/source, Packagist5.13.1OSV
  • redaxo/source, Packagist5.13.2OSV
  • redaxo/source, Packagist5.13.3OSV
  • redaxo/source, Packagist5.14.0OSV
  • redaxo/source, Packagist5.14.0-beta1OSV
  • redaxo/source, Packagist5.14.0-beta2OSV
  • redaxo/source, Packagist5.14.1OSV
  • redaxo/source, Packagist5.14.2OSV
  • redaxo/source, Packagist5.14.3OSV
  • redaxo/source, Packagist5.15.0OSV
  • redaxo/source, Packagist5.15.0-beta1OSV
  • redaxo/source, Packagist5.15.1OSV
  • redaxo/source, Packagist5.16.0OSV
  • redaxo/source, Packagist5.16.0-beta1OSV
  • redaxo/source, Packagist5.16.1OSV
  • redaxo/source, Packagist5.17.0OSV
  • redaxo/source, Packagist5.17.1OSV
  • redaxo/source, Packagist5.18.0OSV
  • redaxo/source, Packagist5.18.1OSV
  • redaxo/source, Packagist5.18.2OSV
  • redaxo/source, Packagist5.18.3OSV
  • redaxo/source, Packagist5.19.0OSV
  • redaxo/source, Packagist5.20.0OSV
  • redaxo/source, Packagist5.20.1OSV
  • redaxo/source, Packagist5.20.2OSV
  • redaxo/source, Packagist5.21.0-beta1OSV

References 2