Medium severity4.8NVD Advisory· Published Sep 23, 2026· Updated Oct 19, 2026
CVE-2026-63002
CVE-2026-63002
Description
REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
redaxo/sourcePackagist | < 5.21.2 | 5.21.2 |
Affected products
3Patches
Vulnerability mechanics
References
5- github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7cnvdPatchWEB
- github.com/redaxo/core/pull/6581nvdIssue TrackingPatchWEB
- github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4mnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-w998-qmw9-mf4mghsaADVISORY
- github.com/redaxo/core/releases/tag/5.21.2nvdRelease NotesWEB
News mentions
0No linked articles in our index yet.