---
id: CVE-2026-63002
title: REDAXO is a PHP-based content management system
summary: >-
  REDAXO is a PHP-based content management system. Prior to 5.21.2,
  redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in
  $diffFiles from the media filesystem into the Mediapool Sync page without
  rex_escape(). An attacker wh…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: redaxo
product: core
affected:
  - core < 5.21.2
patched:
  - redaxo/source 5.21.2
published: '2026-09-23'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T15:17:26.490'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-63002'
references:
  - url: >-
      https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c
    label: security-advisories@github.com
  - url: 'https://github.com/redaxo/core/pull/6581'
    label: security-advisories@github.com
  - url: 'https://github.com/redaxo/core/releases/tag/5.21.2'
    label: security-advisories@github.com
  - url: 'https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m'
    label: security-advisories@github.com
  - url: 'https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
  - url: 'https://github.com/advisories/GHSA-w998-qmw9-mf4m'
tags:
  - nvd
  - cve.org
  - exploit-available
  - ghsa
  - composer
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-24T14:26:05.685430Z'
aliases:
  - GHSA-w998-qmw9-mf4m
ecosystem: composer
ingestedAt: '2026-09-23T14:25:29.804Z'
---

## Overview

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-63002)

Affected packages:

- `redaxo/source <= 5.21.1`

Patched in:

- `redaxo/source 5.21.2`

Source: https://github.com/advisories/GHSA-w998-qmw9-mf4m