CVE-2026-117535

Medium

Description

REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator.

SeverityMedium

CVSS6.1

Exploit probability—

Product

Redaxo Core

PublishedOct 27, 2026

First seenOct 27, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

redaxo core5.21.3 or later

Vendor advisories

github.com/redaxo/core/security/advisories/GHSA-5293-gg47-5xmh

Affected products

Product	Affected versions	Fixed in
redaxo core	v < 5.21.3	5.21.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.