CVE-2026-116895
Received Received - Intake

Cross-Site Request Forgery in REDAXO CMS

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulnCheck

Description
REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET parameter in index.php without validating a CSRF token. Attackers can lure a logged-in administrator into opening a crafted link to disable global safe mode, writing safe_mode: false to config.yml, or enable session safe mode, disabling backend addons.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-116895
EUVD
EUVD-2026-110791

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redaxo core 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-116895 is a Cross-Site Request Forgery (CSRF) vulnerability in REDAXO CMS versions before 5.21.5. It allows attackers to trick logged-in administrators into clicking malicious links that change the safe mode settings via the 'safemode' GET parameter in index.php. This can disable global safe mode or enable session safe mode, disabling backend addons.

Detection Guidance

To detect this vulnerability, check if your REDAXO instance is running a version prior to 5.21.5. Inspect the config.yml file for unexpected changes to the safe_mode setting. Monitor server logs for suspicious GET requests to index.php with the safemode parameter.

Impact Analysis

If exploited, this vulnerability could allow attackers to disable global safe mode by writing 'safe_mode: false' to config.yml or enable session safe mode, which restricts backend functionality. This requires the victim to be an administrator and the system not in live mode.

Mitigation Strategies

Immediately update REDAXO to version 5.21.5 or later to add CSRF token validation for the safemode parameter. If updating is not possible, disable the safemode parameter in index.php or restrict access to the backend for administrators only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116895. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart