CVE-2026-117533

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rexmediaservice moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave...

CVE-2026-117533

REDAXO versions 5.18.0 before 5.21.4 are vulnerable to a stored cross-site scripting (XSS) vulnerability within the rex_media_service component. The root cause is that the service moves uploaded SVG files into the public media folder before the sanitization process occurs. Authenticated users wit...

CVE-2026-117533 REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rexmediaservice moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave...

EUVD-2026-110798

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rexmediaservice moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave...