CVE-2026-117533 - REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves up
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
MEDIUM
Severity & confidence
Source severitymedium
Platform severitymedium
Confidencehigh
Exploitationunknown
CVSS4.4
Affected
Reporting sources (1)
NIST NVD - National Vulnerability Database
Timeline & provenance
Published2026-10-27T11:17:33
Last updated2026-10-30T05:31:50
Ingested2026-10-29T21:24:08
FreshnessNEAR-REAL-TIME
Threat typevulnerability
Recommended action
No recommended action published with this item - review the original source.
Next steps
- Identify affected systems in your environment.
- Apply the vendor patch or mitigation guidance.
- Review logs for indicators described in the advisory.
- Follow the affected vendor/product to track updates.
Confidence explanation
Reported by a government or cert-grade source (CISA, NCSC, NVD, ENISA, MSRC).
Source type: standards ยท Original: NIST NVD - National Vulnerability Database
