CVE-2026-117533

Name of the Vulnerable Software and Affected Versions REDAXO versions 5.18.0 through 5.21.3

Description A stored cross-site scripting issue exists because the rex media service moves uploaded SVG files into the public media folder before the sanitization process is complete. Authenticated users with mediapool upload permissions can exploit this by racing the sanitizer or exhausting memory limits, allowing malicious scripts within SVG files to be served publicly and executed in the backend sessions of other users.

Recommendations Update REDAXO to version 5.21.4 or later.