GHSA-xq4j-g85q-wf97: REDAXO has reflected XSS backend packages API via function parameter (CSRF token required)

April 10, 2026

A reflected XSS vulnerability has been identified in the REDAXO backend. The function parameter is concatenated into an API error message and rendered without HTML escaping.

References

github.com/advisories/GHSA-xq4j-g85q-wf97
github.com/redaxo/core
github.com/redaxo/core/releases/tag/5.21.0
github.com/redaxo/core/security/advisories/GHSA-xq4j-g85q-wf97

Code Behaviors & Features

Detect and mitigate GHSA-xq4j-g85q-wf97 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →