{"id":"CVE-2026-63002","title":"REDAXO is a PHP-based content management system","summary":"REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker wh…","severity":"medium","cvss":4.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-79"],"vendor":"redaxo","product":"core","affected":["core < 5.21.2"],"patched":["redaxo/source 5.21.2"],"published":"2026-09-23","updated":"2026-09-23","sourceUpdated":"2026-09-23T15:17:15.770","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-63002","references":[{"url":"https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c","label":"security-advisories@github.com"},{"url":"https://github.com/redaxo/core/pull/6581","label":"security-advisories@github.com"},{"url":"https://github.com/redaxo/core/releases/tag/5.21.2","label":"security-advisories@github.com"},{"url":"https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m","label":"security-advisories@github.com"},{"url":"https://github.com/advisories/GHSA-w998-qmw9-mf4m"}],"tags":["nvd","cve.org","ghsa","composer"],"aliases":["GHSA-w998-qmw9-mf4m"],"ecosystem":"composer","ingestedAt":"2026-09-23T14:25:29.804Z","slug":"CVE-2026-63002","body":"## Overview\n\nREDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-63002)\n\nAffected packages:\n\n- `redaxo/source <= 5.21.1`\n\nPatched in:\n\n- `redaxo/source 5.21.2`\n\nSource: https://github.com/advisories/GHSA-w998-qmw9-mf4m","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":26.4,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}