REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c Patch
- https://github.com/redaxo/core/pull/6581 Issue Tracking, Patch
- https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m Exploit, Vendor Advisory
- https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 4.8 · redaxoNVD modified 2026-10-19 20:36
Affected (CPE criteria) 1
cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*
References 5
- https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c Patch
- https://github.com/redaxo/core/pull/6581 Issue Tracking, Patch
- https://github.com/redaxo/core/releases/tag/5.21.2 Release Notes
- https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m Exploit, Vendor Advisory
- https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m Exploit, Vendor Advisory