---
id: "CVE-2026-117533"
kind: "vulnerability"
aliases: ["CVE-2026-117533"]
title: "REDAXO: stored XSS via uploaded SVG files in media pool"
severity: "medium"
cvss: 4.4
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cms", "package", "php", "redaxo", "self-hosted"]
not_affected_if: ["auth-required", "default-config"]
published_at: "2026-10-27T11:17:33+00:00"
first_seen_at: "2026-10-27T11:31:28+00:00"
updated_at: "2026-10-27T11:32:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117533", "first_seen_at": "2026-10-27T11:31:28+00:00"}]
---

# REDAXO: stored XSS via uploaded SVG files in media pool

REDAXO from 5.18.0 before 5.21.4 moves uploaded SVG files into the public media folder before sanitizing them. An authenticated user with media pool upload rights can race the sanitizer or exhaust memory to leave script-laden SVGs publicly served, running scripts in victims' backend sessions.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed REDAXO version in the backend or in `redaxo/src/core/boot.php` (the version constant)
- Look in the public media folder for `.svg` files that were uploaded by users, which may contain `<script>` elements

## Fix

- Upgrade REDAXO to `5.21.4` or later
- Until upgraded, restrict media pool upload rights to trusted users only

## Timeline

- 2026-10-27T11:31:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117533

## From the sources

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_