{"id":"CVE-2026-117533","kind":"vulnerability","aliases":["CVE-2026-117533"],"related":[],"title":"REDAXO: stored XSS via uploaded SVG files in media pool","description":"REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.","summary":"REDAXO from 5.18.0 before 5.21.4 moves uploaded SVG files into the public media folder before sanitizing them. An authenticated user with media pool upload rights can race the sanitizer or exhaust memory to leave script-laden SVGs publicly served, running scripts in victims' backend sessions.","severity":"medium","cvss":4.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cms","package","php","redaxo","self-hosted"],"not_affected_if":["auth-required","default-config"],"how_to_check":"- Check the installed REDAXO version in the backend or in `redaxo/src/core/boot.php` (the version constant)\n- Look in the public media folder for `.svg` files that were uploaded by users, which may contain `<script>` elements","fix":"- Upgrade REDAXO to `5.21.4` or later\n- Until upgraded, restrict media pool upload rights to trusted users only","status":"open","published_at":"2026-10-27T11:17:33+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","triaged_at":"2026-10-27T11:32:19+00:00","updated_at":"2026-10-27T11:32:19+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T11:32:19Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade REDAXO to `5.21.4` or later\n- Until upgraded, restrict media pool upload rights to trusted users only","reach":"internet","title":"REDAXO: stored XSS via uploaded SVG files in media pool","impact":"medium","summary":"REDAXO from 5.18.0 before 5.21.4 moves uploaded SVG files into the public media folder before sanitizing them. An authenticated user with media pool upload rights can race the sanitizer or exhaust memory to leave script-laden SVGs publicly served, running scripts in victims' backend sessions.","category":"package","nicknames":[],"who_cares":["redaxo","php","self-hosted","cms"],"confidence":0.7,"needs_auth":"yes","worst_case":"script runs in backend sessions of victims, hijacking admin accounts","analyst_note":"","how_to_check":"- Check the installed REDAXO version in the backend or in `redaxo/src/core/boot.php` (the version constant)\n- Look in the public media folder for `.svg` files that were uploaded by users, which may contain `<script>` elements","needs_analyst":false,"not_affected_if":["default-config","auth-required"],"who_is_affected":"Sites running REDAXO between 5.18.0 and 5.21.4 where users have media pool upload rights can be exposed, since SVG uploads are stored in the public media folder before sanitization. Sites that do not allow SVG uploads or limit uploads to trusted editors have lower risk. Installations on 5.21.4 or later are not affected.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000621,"input_tokens":3358,"output_tokens":571,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117533':13A,16A '-2026':12A,15A '5.18.0':26B,72C '5.21.4':28B,74C 'authent':42B,99C 'backend':68B,125C 'cms':17B 'contain':75C 'cross':79C 'cross-sit':78C 'cve':11A,14A 'execut':121C 'exhaust':54B,110C 'file':7A,32B,90C 'folder':37B,95C 'host':23B 'laden':60B,117C 'leav':57B,114C 'limit':112C 'media':9A,36B,45B,85C,94C 'mediapool':102C 'memori':55B,111C 'move':29B,87C 'packag':18B 'php':19B 'pool':10A,46B 'public':35B,62B,93C,119C 'race':50B,106C 'redaxo':1A,20B,24B,70C 'rex':84C 'right':48B,104C 'run':64B 'sanit':39B,52B,97C,108C 'script':59B,65B,81C,116C,122C 'script-laden':58B,115C 'self':22B 'self-host':21B 'serv':63B,120C 'servic':86C 'session':69B,126C 'site':80C 'store':2A,77C 'svg':6A,31B,89C 'svgs':61B,118C 'upload':5A,30B,47B,88C,103C 'user':43B,100C 'via':4A 'victim':67B,124C 'vulner':82C 'xss':3A","nicknames":[],"mitigations":[],"who_affected":"Sites running REDAXO between 5.18.0 and 5.21.4 where users have media pool upload rights can be exposed, since SVG uploads are stored in the public media folder before sanitization. Sites that do not allow SVG uploads or limit uploads to trusted editors have lower risk. Installations on 5.21.4 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T11:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117533","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117533","severity":null,"published_at":"2026-10-27T11:17:33+00:00","modified_at":"2026-10-27T11:17:33+00:00","first_seen_at":"2026-10-27T11:31:28+00:00","fetched_at":"2026-10-27T11:31:28+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}