Cross-site request forgery in REDAXO - #VU140668
Published: August 1, 2026
Vulnerability identifier: #VU140668
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-352
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause loss of recovery data.
The vulnerability exists due to cross-site request forgery in the article history plugin history administration page when handling a crafted top-level GET request with the func=clearall parameter. A remote attacker can trick a logged-in victim into opening an attacker-controlled page to cause loss of recovery data.
This action permanently deletes every stored article snapshot and requires user interaction from an administrator victim who is logged into the backend.
Affected software
REDAXO
Remediation
Install security update from vendor's website.
REDAXO - update to 5.21.3