CVE-2026-117533
CVE-2026-117533 · REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
CVSS 2.1 · Baja · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
core
- Versiones
- ≥ 5.18.0, < 5.21.4: Afectada (semver)
- 5.21.4: No afectada (semver)
Actualiza a 5.21.4