CVE-2026-63002

Undergoing Analysis Undergoing Analysis - In Progress

Stored XSS in REDAXO Media Sync via Unescaped Filenames

Publication date: 2026-09-23

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-24

Generated

2026-09-24

AI Q&A

2026-09-23

EPSS Evaluated

N/A

NVD

CVE-2026-63002

EUVD

EUVD-2026-85331

Affected Vendors & Products

Vendor	Product	Version / Range
redaxo	redaxo	to 5.21.2 (exc)
redaxo	redaxo	5.21.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in REDAXO CMS versions 5.21.1 and earlier. It occurs because filenames from the media filesystem are inserted into HTML without proper escaping. An attacker can place a file with a malicious filename containing HTML metacharacters in the media directory. When a backend user with media[sync] permission views the Sync page, the malicious filename executes JavaScript in their browser.

Detection Guidance

Check for unregistered files with HTML metacharacters in the /media directory. Review the Mediapool Sync page in REDAXO admin for unexpected script execution. Look for files with names containing <, >, or other HTML tags.

Impact Analysis

An attacker could steal session cookies, steal credentials, or perform unauthorized actions in the backend. This could lead to full CMS takeover if the victim has high privileges. The impact depends on the permissions of the affected user.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations using vulnerable versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade REDAXO to version 5.21.2 or later. If immediate upgrade is not possible, restrict access to the Mediapool Sync page to trusted users only. Monitor /media directory for suspicious filenames.

Hi! I’m here to help you understand CVE-2026-63002. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70