CVE-2026-63002: REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

September 23, 2026

The mediapool sync page (sync.php) renders filenames from the /media filesystem directory directly into HTML without applying rex_escape() (i.e., htmlspecialchars). Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any backend user who views the sync page.

References

github.com/advisories/GHSA-w998-qmw9-mf4m
github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c
github.com/redaxo/core/pull/6581
github.com/redaxo/core/releases/tag/5.21.2
github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m
nvd.nist.gov/vuln/detail/CVE-2026-63002

Code Behaviors & Features

Detect and mitigate CVE-2026-63002 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →