---
id: CVE-2026-117533
title: REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized Mediapool SVG Uploads
summary: >-
  REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting
  vulnerability because rex_media_service moves uploaded SVG files into the
  public media folder before sanitizing them. Authenticated users with mediapool
  upload right…
severity: medium
cvss: 4.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: redaxo
product: core
affected:
  - core >= 5.18.0 < 5.21.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-27T13:42:32.102429Z'
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:12:29.808Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117533'
references:
  - url: 'https://github.com/redaxo/core/security/advisories/GHSA-2p3g-jr7p-qwwx'
    label: GitHub Security Advisory (GHSA-2p3g-jr7p-qwwx)
  - url: >-
      https://www.vulncheck.com/advisories/redaxo-5.18.0-before-5.21.4-stored-xss-via-unsanitized-mediapool-svg-uploads
    label: >-
      VulnCheck Advisory: REDAXO 5.18.0 before 5.21.4 Stored XSS via Unsanitized
      Mediapool SVG Uploads
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.442Z'
---

## Overview

REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.

## Affected

- `core >= 5.18.0 < 5.21.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.