CVE-2026-117533
CVE-2026-117533 · REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
This page contains facts from public vulnerability sources. Check the original advisory before updating.
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
CVSS 2.1 · Low · Fix available
- Published
- Updated
Affected products and versions
core
- Versions
- ≥ 5.18.0, < 5.21.4: Affected (semver)
- 5.21.4: Not affected (semver)
Update to 5.21.4