Medium severity · published Oct 27, 2026
CVE-2026-117537
REDAXO before 5.21.0 Reflected XSS via Metainfo API type Parameter
New
4.1
CVSS
–
EPSS
No
On KEV
Description
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to inject scripts via the type parameter of the metainfo_default_fields_create API. Attackers can craft a link with a valid CSRF token and HTML payload that rex_view::message() renders unescaped, executing scripts in a victim's backend session.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
High
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CO
core · redaxo
before 5.21.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-117537
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-117537
github.com
https://github.com/redaxo/core/security/advisories/GHSA-m662-8jrj-cw6v
www.vulncheck.com
https://www.vulncheck.com/advisories/redaxo-before-5.21.0-reflected-xss-via-metainfo-api-type-parameter
More from core
9.8
CVE-2026-117532
REDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History Plugin
8.8
CVE-2026-117536
REDAXO before 5.21.3 CSRF Token Bypass via users/users Privilege Escalation
7.5
CVE-2026-116896
REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
7.5
CVE-2026-53599
Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers
7.1
CVE-2026-116898
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move