# CVE-2026-117535: REDAXO reflected cross-site scripting in media pool

Source: https://junglewise.ai/threats/cve-2026-117535-redaxo-before-5-21-3-contains-a-reflected-cross-site-scripting  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-117535 · Severity: medium · CVSS 6.1 · Published 2026-10-27

REDAXO is a web content management system used to manage website content and media assets. A reflected cross-site scripting vulnerability in the backend media pool allows an attacker to craft a malicious link that, when clicked by a logged-in administrator, can execute arbitrary code on the website through template or module edits. This could lead to full website compromise and code execution.

Technologies: [REDAXO](https://junglewise.ai/threats/technologies/redaxo). Vendors: [REDAXO](https://junglewise.ai/threats/vendors/redaxo).

## Quick answers

**Is CVE-2026-117535 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117535 being exploited in the wild.

**How severe is CVE-2026-117535?** Medium severity, with a CVSS score of 6.1, published 27 October 2026.

**Which products and versions are affected?** REDAXO before 5.21.3.

**Is there a fix for CVE-2026-117535?** Yes: fixed in 5.21.3. Until then: Strip or block the opener_link query parameter for backend requests at the web server or reverse proxy level until upgrading. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117535 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-117535?** Check whether you run REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 5.21.3

Strip or block the opener_link query parameter for backend requests at the web server or reverse proxy level until upgrading.

## Technical details

A reflected XSS vulnerability exists in the media pool detail page where the opener_link request parameter is rendered without HTML escaping. Exploitation requires a logged-in backend user with media permissions to click a crafted link; the injected script executes in the backend origin with the victim's authenticated session and can extract the CSRF token to perform privileged actions. If the victim is an administrator, the attacker can execute code via template or module edits.

## Affected products

- REDAXO REDAXO before 5.21.3

## Timeline

- 2026-07-31: disclosed
- 2026-10-27: advisory
- 2026-10-27: patched

## References

- [https://github.com/redaxo/core/security/advisories/GHSA-5293-gg47-5xmh](https://github.com/redaxo/core/security/advisories/GHSA-5293-gg47-5xmh)
- [https://www.vulncheck.com/advisories/redaxo-before-5.21.3-reflected-xss-via-opener-link-in-media-pool](https://www.vulncheck.com/advisories/redaxo-before-5.21.3-reflected-xss-via-opener-link-in-media-pool)

## Related threats

- [REDAXO reflected XSS in metainfo API type parameter](https://junglewise.ai/threats/cve-2026-117537-redaxo-before-5-21-0-contains-a-reflected-cross-site-scripting)
- [REDAXO CSRF token bypass in user administration](https://junglewise.ai/threats/cve-2026-117536-redaxo-before-5-21-3-contains-a-cross-site-request-forgery)
- [REDAXO cross-site request forgery in article history plugin](https://junglewise.ai/threats/cve-2026-117534-redaxo-before-5-21-3-contains-a-cross-site-request-forgery)
- [REDAXO stored cross-site scripting in mediapool SVG uploads](https://junglewise.ai/threats/cve-2026-117533-redaxo-from-5-18-0-before-5-21-4-contains-a-stored-cross-site)
- [REDAXO stored cross-site scripting in media and link widgets](https://junglewise.ai/threats/cve-2026-116900-redaxo-before-5-21-4-contains-a-stored-cross-site-scripting)