CVE-2026-117533: REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rexmediaservice moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
REDAXO versions from 5.18.0 before 5.21.4 are affected where authenticated users have Mediapool upload rights and can upload SVG files. The vulnerable files may be publicly served from the media folder.
What does an attacker need to exploit this issue?
An attacker needs an authenticated account with Mediapool upload permissions and must upload a script-containing SVG. Exploitation requires racing the sanitizer or causing it to exhaust available memory, and a victim must load the SVG in a backend session.
Are unauthenticated attackers able to upload the malicious SVG directly?
The provided information identifies Mediapool upload rights as a prerequisite, so exploitation requires an authenticated user with those permissions. It does not state that unauthenticated upload is possible.
How can I assess whether an attempted compromise may have occurred?
Review SVG files in the public media folder, particularly uploads from users with Mediapool access, for embedded script content. The issue can leave script-laden SVGs publicly served when sanitization is raced or fails due to memory exhaustion.