Stored Cross-Site Scripting in REDAXO by REDAXO Team
CVE-2026-117533

2.1LOW

Key Information:

Vendor

Redaxo

Status
Core
Vendor
CVE Published:
27 October 2026

What is CVE-2026-117533?

REDAXO versions prior to 5.21.4 contain a stored cross-site scripting vulnerability due to improper handling of uploaded SVG files. Authenticated users with rights to upload files can exploit this vulnerability by bypassing the sanitization process. The rex_media_service moves uploaded SVG files into the public media folder without adequate sanitation, allowing for script-laden SVGs to be served publicly. This can result in the execution of malicious scripts within the sessions of users who access the compromised media, potentially leading to data theft and unauthorized access.

Affected Version(s)

core 5.18.0 < 5.21.4

core 5.21.4

References

https://github.com/redaxo/core/security/advisories/GHSA-2...
vendor-advisory
https://www.vulncheck.com/advisories/redaxo-5.18.0-before...
third-party-advisory

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

alham-rizvi
.