CVE-2026-116895: redaxo core, CSRF

Описание

Оригинално описание

REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.

Засегнати продукти

• redaxo core: преди 5.21.5; 5.21.5

Вид слабост

• CWE-352 CSRF

История

Други уязвимости в redaxo core

• 4.1CVE-2026-117538
• 4.1CVE-2026-117537
• 8.8CVE-2026-117536
• 6.1CVE-2026-117535
• 5.4CVE-2026-117534

Първоизточници

• https://www.cve.org/CVERecord?id=CVE-2026-116895
• https://nvd.nist.gov/vuln/detail/CVE-2026-116895
• https://github.com/redaxo/core/security/advisories/GHSA-423v-8x3h-gxr3
• https://www.vulncheck.com/advisories/redaxo-before-5.21.5-csrf-via-safe-mode-toggle-parameter