REDAXO EUVD-2026-110802

Exploitation requires three concurrent conditions, all drawn from the advisory: (1) the attacker must already possess an authenticated REDAXO backend session with sufficient privilege to reach the metainfo_default_fields_create API (PR:H); (2) a valid per-session _csrf_token must be obtained and embedded in the crafted link (the GHSA PoC harvests it from the metainfo/articles page); and (3) an authenticated backend user must open the attacker-crafted link so the reflected payload renders in their session. Strong limiting factors: the mandatory CSRF token tied to a live backend session sharply narrows realistic attack scenarios, HttpOnly cookies prevent direct session-cookie theft (vendor-stated), and no unauthenticated or default-configuration path exists. Affected: REDAXO core before 5.21.0; fixed in 5.21.0.

All independent signals converge on genuinely low real-world risk. The vendor's CVSS 4.0 base score is 2.1 (Low), and the SSVC decision framework reports Exploitation: none, Automatable: no, Technical Impact: partial - which maps directly to the vuln.today 'monitor' priority rather than any act-now posture. The CVSS vector (AV:N/AC:L/AT:P/PR:H/UI:N) describes a network-reachable but privilege-gated and attack-requirement-constrained flaw: PR:H confirms the attacker must already hold a high-privileged backend session, and AT:P reflects the hard dependency on a valid per-session CSRF token. This is a reflected XSS whose impacts are all Low (VC:L/VI:L/VA:L) with no scope/subsequent-system change (SC:N/SI:N/SA:N). No EPSS score was supplied in the input, and the CVE is not on CISA KEV, so there is no evidence of active or widespread exploitation. A public PoC does exist in the GHSA advisory, but PoC availability is a distinct signal from exploitation and does not raise this to a priority. The one point requiring judgment: the vendor set UI:N while the mechanism (victim must open an attacker-crafted backend link) is classically user-interaction-dependent; this is noted but does not change the low overall rating.

An attacker who already holds an authenticated REDAXO backend session extracts a valid _csrf_token from the metainfo page and crafts a link to the metainfo_default_fields_create API with a malicious HTML/JavaScript payload in the type parameter; the error path reflects that value unescaped through rex_view::message(). When another logged-in backend user opens the crafted link, the script executes in their backend session context. A working PoC helper that builds the exploit URL is published in the GHSA advisory, so the technique is documented publicly.