Medium severity5.4NVD Advisory· Published Oct 27, 2026

CVE-2026-117534

Description

REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows attackers to delete history or roll back content via unvalidated GET requests. Attackers can lure logged-in backend users to a page triggering func=clearall or rex_history_function=snap, permanently deleting all article snapshots or reverting articles to earlier states.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Redaxo/structure/history pluginllm-create
Range: <5.21.3
Redaxo/corellm-fuzzy
Range: <5.21.3

Patches

Vulnerability mechanics

References

github.com/redaxo/core/security/advisories/GHSA-vjwx-3c33-xwmcnvd
www.vulncheck.com/advisories/redaxo-before-5.21.3-csrf-in-article-history-pluginnvd

News mentions

No linked articles in our index yet.

cvss	0.351
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000