CVE-2026-117538

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.21.0

Description A reflected cross-site scripting issue exists in the backend packages API. The problem occurs because a function parameter is concatenated into an error message that is rendered without HTML escaping. This allows an attacker to trick an authenticated backend user into clicking a crafted link containing a valid CSRF token to execute JavaScript, which can then perform same-origin actions or read DOM data.

Recommendations Update to version 5.21.0 or later.