CVE-2026-117537 redaxo CVE debrief

Who should care

Defenders responsible for REDAXO backend security, administrators, and developers should assess exposure and implement compensating controls. They should verify backend session and CSRF token usage, implement input validation and output encoding, and monitor for potential XSS attacks. The vulnerability requires a backend session and CSRF token, and defenders should prioritize remediation due to the potential for XSS attacks. Defenders should also review

Why it matters

A reflected XSS vulnerability exists in the REDAXO backend Metainfo API, requiring a backend session and CSRF token. Defenders should verify exposure, implement compensating controls, and prioritize remediation.

• Potential XSS attacks require verification from official sources
• Defenders must verify backend session and CSRF token usage
• Implementing compensating controls is necessary
• Remediation priority is high due to potential for XSS attacks

Technical summary

The vulnerability exists in the REDAXO backend Metainfo API, where user input `type` is concatenated into an API error message and rendered without HTML escaping. This requires a backend session and CSRF token. The affected code is in `redaxo/src/addons/metainfo/lib/handler/api_default_fields.php` and `redaxo/src/core/lib/view.php`. The vulnerability allows for potential XSS attacks, and defenders should verify exposure and implement compensating controls. The vulnerability has a high remediation priority due to the potential for XSS attacks.

Defensive priority

Defenders should prioritize verifying exposure and implementing compensating controls, as the vulnerability requires a backend session and CSRF token.

Recommended defensive actions

• Verify exposure by reviewing backend session and CSRF token usage
• Implement compensating controls, such as input validation and output encoding
• Monitor for potential XSS attacks
• Update to version 5.21.0 or later
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is caused by user input `type` being injected into an exception message and rendered without HTML escaping. The affected code is in `redaxo/src/addons/metainfo/lib/handler/api_default_fields.php` and `redaxo/src/core/lib/view.php`.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.