CVE-2026-117538

REDAXO versions before 5.21.0 are vulnerable to a reflected cross-site scripting (XSS) vulnerability within the backend packages API . The root cause is the lack of HTML escaping when a function parameter is concatenated into an error message. An attacker can trick an authenticated backend user i...