CVE-2026-117535 Details
Description
REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator.
A reflected cross-site scripting vulnerability has been identified in REDAXO versions prior to 5.21.3. The issue resides in the backend media pool detail page, where the 'opener_link' parameter is processed without proper HTML escaping. This flaw allows unauthenticated attackers to trick logged-in backend users with media permissions into clicking a malicious link. Once clicked, the injected script can access the CSRF token and execute actions on behalf of the victim, potentially leading to code execution through template or module edits, especially if the victim is an administrator.
Users are advised to upgrade to REDAXO version 5.21.3 or later, where this vulnerability has been fixed. If an immediate upgrade is not possible, the 'opener_link' query parameter can be stripped or blocked for backend requests at the web server or reverse proxy level.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 27, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/redaxo/core/security/advisories/GHSA-5293-gg47-5xmh | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/redaxo-before-5.21.3-reflected-xss-via-opener-link-in-media-pool | [email protected] | AdvisoryVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| REDAXO | <= 5.21.2 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 27, 2026 | New CVE Received | [email protected] |