EUVD-2026-110798

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rexmediaservice moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave...