REDAXO reflected XSS in backend packages API

Executive brief

REDAXO is a content management system used to build and manage websites. A security flaw in its administrative backend allows malicious code to be reflected back to a user through the packages API. While an exploit requires high-level administrative access and a valid security token, it could allow an attacker to perform unauthorized actions or view sensitive data within the management interface.

Technical details

A reflected Cross-Site Scripting (XSS) vulnerability exists in the REDAXO backend packages API. The root cause is the lack of HTML escaping when the 'function' GET parameter is concatenated into an exception message in 'redaxo/src/core/lib/packages/api_package.php' and subsequently rendered via 'rex_view::error()'. An attacker with high privileges (backend session) can inject arbitrary JavaScript. However, exploitation is mitigated by the requirement of a valid CSRF token ('_csrf_token') for the API call. The vulnerability is patched in version 5.21.0.

Affected products

• REDAXO core < 5.21.0

Timeline

• 2026-04-09: patched: Release 5.21.0 published.
• 2026-04-10: advisory: GitHub Advisory GHSA-xq4j-g85q-wf97 published.

References

• https://api.github.com/users/NumberOreo1
• https://github.com/NumberOreo1
• https://api.github.com/users/NumberOreo1/gists%7B/gist_id%7D
• https://api.github.com/users/NumberOreo1/repos
• https://avatars.githubusercontent.com/u/122526229?v=4
• https://api.github.com/users/NumberOreo1/events%7B/privacy%7D