CVE-2026-117538 redaxo CVE debrief

Who should care

Defenders managing REDAXO installations, especially those with backend access, should assess exposure and verify their version of the redaxo/source package. They must ensure that version 5.21.0 or later is used to prevent exploitation. This involves reviewing current exposure, implementing additional security measures for backend sessions and CSRF tokens, and monitoring for suspicious activity.

Why it matters

Defenders should care about CVE-2026-117538 because it represents a reflected XSS vulnerability in the REDAXO backend, requiring a valid session for exploitation. The vulnerability can lead to script injection, potential disruption, and sensitive information exposure. Defenders managing REDAXO installations, especially with backend access, must verify exposure and ensure version 5.21.0 or later of the redaxo/source package is used.

• Potential for attackers to inject malicious scripts in the context of a backend session
• Possible disruption of backend operations through injected scripts
• Risk of sensitive information exposure through XSS in a privileged context
• Need for verification of current exposure and remediation to prevent exploitation

Technical summary

The REDAXO backend is vulnerable to reflected XSS via the function parameter in the packages API. The issue arises from user input being concatenated into an exception message and rendered without HTML escaping. A valid backend session is required for exploitation. The vulnerability can lead to script injection, potential disruption, and sensitive information exposure. Defenders should prioritize verifying exposure in their REDAXO installations, especially those with backend access, and ensure they are running version 5.21.0 or later of the redaxo/source package.

Defensive priority

Defenders should prioritize verifying exposure in their REDAXO installations, especially those with backend access, and ensure they are running version 5.21.0 or later of the redaxo/source package.

Recommended defensive actions

• Verify REDAXO installations for exposure, especially those with backend access
• Ensure redaxo/source package version is 5.21.0 or later
• Monitor for suspicious backend activity
• Implement additional security measures for backend sessions and CSRF tokens
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in versions prior to 5.21.0 of the redaxo/source package. The fix is confirmed in version 5.21.0. Source-grounded evidence indicates that the issue arises from user input being concatenated into an exception message and rendered without HTML escaping. Defenders should verify current exposure and remediation to prevent exploitation, considering the limited source detail and potential for script injection.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.