GHSA-m662-8jrj-cw6v: REDAXO has reflected XSS in backend Metainfo API via type parameter (CSRF token required)

April 10, 2026

A reflected XSS vulnerability has been identified in the REDAXO backend. The type parameter is concatenated into an API error message and rendered without HTML escaping.

References

github.com/advisories/GHSA-m662-8jrj-cw6v
github.com/redaxo/core
github.com/redaxo/core/releases/tag/5.21.0
github.com/redaxo/core/security/advisories/GHSA-m662-8jrj-cw6v

Code Behaviors & Features

Detect and mitigate GHSA-m662-8jrj-cw6v with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →