CVE-2026-117533
CVE-2026-117533 · REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
CVSS 2.1 · Faible · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
core
- Versions du logiciel
- ≥ 5.18.0, < 5.21.4: Concernée (semver)
- 5.21.4: Non concernée (semver)
Mettez à jour vers 5.21.4