A reflected cross‑site scripting flaw exists in the backend packages API of Redaxo. The function parameter is concatenated into an error message that is rendered without HTML escaping, allowing an attacker to inject arbitrary JavaScript when an authenticated backend user follows a specially crafted link. This is a typical CWE‑79 vulnerability that can be exploited to perform same‑origin actions or read DOM data.

All installations of Redaxo core running a version earlier than 5.21.0 are affected. The issue is tied to the backend packages API and does not depend on specific plugins or extensions.

The CVSS score of 2.1 indicates low severity, and the vulnerability is not listed in CISA’s KEV catalog. Since no EPSS score is available, the exploitation probability cannot be quantified. Exploitation requires that an authenticated backend user be lured into clicking a malicious URL that contains a valid CSRF token. That attack relies on social engineering. While the likelihood of widespread exploitation is low, an attacker who succeeds can execute same‑origin JavaScript and potentially compromise the backend session or read sensitive data.