CVE-2026-117537

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.0

Description Authenticated attackers can perform a reflected cross-site scripting attack by injecting scripts through the type parameter of the 'metainfo default fields create' API. This occurs because the rex view::message() function renders the HTML payload unescaped, allowing the execution of scripts within a victim's backend session when they follow a crafted link containing a valid CSRF token.

Recommendations Update to version 5.21.0 or later. As a temporary mitigation, restrict access to the 'metainfo default fields create' API endpoint.