CVE-2026-117533 in REDAXO
Summary
by MITRE • 10/27/2026
REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can race the sanitizer or exhaust memory limits to leave script-laden SVGs publicly served, executing scripts in victims' backend sessions.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/27/2026
The identified vulnerability within REDAXO versions prior to 5.21.4 represents a critical stored cross-site scripting flaw rooted in an insecure file handling mechanism during media upload operations. Specifically, the rex_media_service component exhibits a race condition and improper sanitization sequence when processing Scalable Vector Graphics files. The core technical failure lies in the temporal ordering of operations: the system moves uploaded SVG files into the public media directory before executing necessary security checks or sanitization routines. This architectural decision creates a window of opportunity where maliciously crafted content can be persisted on the server and subsequently served to users without adequate filtering, bypassing intended security controls designed to neutralize executable script tags embedded within XML-based vector graphics formats.
From an operational perspective, this vulnerability allows authenticated users who possess mediapool upload privileges to exploit the race condition or exhaust system memory limits associated with SVG parsing libraries. By manipulating the timing of file moves relative to sanitization processes, attackers can force the application to serve un-sanitized content. Alternatively, by crafting complex SVG structures that trigger excessive resource consumption during validation, attackers may cause the sanitizer to fail silently or timeout, resulting in the preservation of malicious payloads on the public-facing server. This effectively transforms a standard media upload feature into an entry point for persistent web attacks against other users accessing the backend interface.
The impact of this vulnerability is significant due to its stored nature and the context in which it executes. Since the malicious SVG files are served from the public media folder, any user with access to the REDAXO backend who views a page containing these images will have their session compromised. The injected scripts execute within the security context of the victim's active administrative session. This enables attackers to perform actions such as stealing session cookies, performing authenticated requests on behalf of the victim, defacing content, or potentially escalating privileges if combined with other vulnerabilities in the application logic. Because the payload is stored server-side, a single successful upload can compromise multiple users over time without further interaction from the attacker.
This vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. Furthermore, it exemplifies CWE-436, Interpretation Conflict, where the application interprets user input differently than intended due to processing order issues. In terms of offensive security frameworks, this attack vector maps directly to MITRE ATT&CK technique T1059.007, Command and Scripting Interpreter: JavaScript, specifically within a web browser context. The exploitation method also reflects CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, as the race condition relies on timing discrepancies between file system operations and security validation steps.
To mitigate this risk, administrators must upgrade REDAXO to version 5.21.4 or later immediately upon availability. The patch addresses the underlying logic error by ensuring that SVG files are fully sanitized before being moved into any public-facing directories. Additionally, organizations should enforce strict input validation policies for all media uploads, implementing allow-lists for permitted file types and content structures rather than relying solely on blacklist-based sanitization. Implementing server-side resource limits to prevent memory exhaustion attacks during parsing operations is also recommended as a defense-in-depth measure. Regular security audits of custom plugins or modules that interact with the mediapool should be conducted to ensure no similar race conditions exist in third-party extensions, and web application firewalls can be configured to detect anomalous SVG upload patterns indicative of exploitation attempts.