Live › vulnerability › CVE-2026-117533
Go to dashboardREDAXO from 5.18.0 before 5.21.4 moves uploaded SVG files into the public media folder before sanitizing them. An authenticated user with media pool upload rights can race the sanitizer or exhaust memory to leave script-laden SVGs publicly served, running scripts in victims' backend sessions.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 11:31 UTC. All times on this page are UTC.
Sites running REDAXO between 5.18.0 and 5.21.4 where users have media pool upload rights can be exposed, since SVG uploads are stored in the public media folder before sanitization. Sites that do not allow SVG uploads or limit uploads to trusted editors have lower risk. Installations on 5.21.4 or later are not affected.
No product ranges from the sources yet.
redaxo/src/core/boot.php (the version constant).svg files that were uploaded by users, which may contain <script> elements5.21.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
This page as .md · .json · in your agent: get_signal("CVE-2026-117533")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.