MEDIUM 5.1 NVD
CVE-2026-116895
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validatin
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.
References
- https://github.com/redaxo/core/security/advisories/GHSA-423v-8x3h-gxr3
- https://www.vulncheck.com/advisories/redaxo-before-5.21.5-csrf-via-safe-mode-toggle-parame
This medium severity vulnerability with a CVSS score of 5.1 was published on 2026-10-27 via NVD.
vulnfeed aggregates 18707 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.