Vulnerability Intelligence Report
REDAXO before 5.21.3 Reflected XSS via opener_link in Media Pool
CVE-2026-117535
REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page, where the opener_link parameter is rendered without HTML escaping. Unauthenticated attackers can lure logged-in backend users with media permissions into clicking a crafted link. The injected script can then read the CSRF token and perform actions with the victim's permissions, including code execution via template or module edits when the victim is an administrator.
Cross-Site Scripting (XSS)
No Active Exploit Signals
CVSS Base Score
5.1
MEDIUM
Executive Threat Verdict
Evaluating...
Evaluating Threat Landscape...
Assessing known weaponization, exploitation telemetry, and federal advisories.
Attack Surface
—
Authentication
—
Weaponization
—
SSVC Action
—
Weaknesses (CWE)
CWE-79 ↗Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products & Versions
| Vendor | Product | Affected Versions |
|---|---|---|
| redaxo | core | 0 < 5.21.3 (affected), 5.21.3 (unaffected) |
References & Technical Advisories
No reference links found.
Threat Intelligence Signals
GitHub Advisory
Vulnerability Class
Cross-Site Scripting (XSS)
Identity & Timeline
| Status | PUBLISHED |
| Assigning Authority | VulnCheck · Bug Bounty Provider · USA |
| Reserved | 2026-10-27T10:33:39 |
| Published | 2026-10-27T10:59:30 |
| Patch Date | 2026-07-31 |
| Last Updated | 2026-10-27T10:59:30 |
Community Chatter & Buzz