CVE-2026-63002: falha de média gravidade em redaxo core
REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 4.8epss 0.2%
REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
redaxo · coreCVEs relacionadas — redaxo core
No mesmo produto, das mais perigosas para as menos.
CVE-2026-117532CRITICALREDAXO Core 5.3.0 before 5.21.4 Authentication Bypass via History PluginEPSS 0.7%CVE-2026-53599HIGHRedaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlersEPSS 0.5%CVE-2026-62998MEDIUMREDAXO: Unwhitelisted ORDER BY Column in rex_list Allows Authenticated Column EnumerationEPSS 0.4%CVE-2026-116893MEDIUMREDAXO core before 5.21.5 Missing Authorization in rex_api_package APIEPSS 0.3%CVE-2026-116896HIGHREDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication TablesEPSS 0.2%CVE-2026-116897HIGHREDAXO before 5.21.4 Missing Authorization in Version and History PreviewsEPSS 0.2%