PT-2026-126368

CVE-2026-117533

·

Published

2026-10-27

·

Updated

2026-10-27

Description by

CVSS 3.1
4.4
Medium
MetricsAV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex media service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
Exploitability
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-117533
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com