REDAXO CMS reflected XSS in backend Metainfo API

Executive brief

REDAXO CMS, a popular content management system, contains a security flaw in its administrative backend. An attacker could potentially execute malicious scripts in the browser of a logged-in administrator. While this could lead to unauthorized actions or data theft within the management interface, the attack is difficult to perform because it requires the attacker to possess a valid security token (CSRF token) and high-level access privileges.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in the REDAXO backend within the Metainfo API handler. The 'type' GET parameter is retrieved in 'redaxo/src/addons/metainfo/lib/handler/api_default_fields.php' and concatenated into a 'rex_api_exception' message. This message is subsequently rendered by 'rex_view::error()' and 'rex_view::message()' without proper HTML escaping, allowing for script injection. Exploitation requires the attacker to be authenticated to the backend with high privileges and to include a valid '_csrf_token' in the request. The vulnerability is patched in version 5.21.0.

Affected products

• REDAXO REDAXO CMS < 5.21.0

Timeline

• 2026-04-09: patched: Version 5.21.0 released.
• 2026-04-10: advisory

References

• https://api.github.com/users/NumberOreo1
• https://github.com/NumberOreo1
• https://api.github.com/users/NumberOreo1/gists%7B/gist_id%7D
• https://api.github.com/users/NumberOreo1/repos
• https://avatars.githubusercontent.com/u/122526229?v=4
• https://api.github.com/users/NumberOreo1/events%7B/privacy%7D