CVE-2026-117538 REDAXO before 5.21.0 Reflected XSS via Packages API function Parameter
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-117538?
CVE-2026-117538 is a low-severity vulnerability in redaxo core, published on 27 Oct 2026.
Official description
REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the function parameter is concatenated into an error message rendered without HTML escaping. Attackers can lure an authenticated backend user to a crafted link containing a valid CSRF token, executing JavaScript that performs same-origin actions or reads DOM data.
Weakness: CWE-79
Which versions are affected by CVE-2026-117538?
2 open source packages ship an affected version, including redaxo/source.
| Package | Affected | Fixed in |
|---|---|---|
redaxo/source Packagist | All versions | 5.21.0 |
redaxo/source Packagist | All versions | 5.21.0 |
How do I fix CVE-2026-117538?
Upgrade redaxo/source to 5.21.0 or later.
Is CVE-2026-117538 being exploited?
There is no known exploitation of CVE-2026-117538 in the wild and no public exploit code.
Sources
Also known as GHSA-4rfx-xhx7-wf22, GHSA-xq4j-g85q-wf97.