CVE-2026-63002

REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.

• CWE-79

• https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c
• https://github.com/redaxo/core/pull/6581
• https://github.com/redaxo/core/releases/tag/5.21.2
• https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m
• https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m

Published

Sep 23, 2026

Last Modified

Sep 24, 2026

Status

Undergoing Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-62997Kedro-Datasets provides data connectors for Kedro. From vers…7.7
• CVE-2026-62998REDAXO is a PHP-based content management system. Prior to 5.…4.3
• CVE-2026-62999Copier is a library and CLI app for rendering project templa…7.5
• CVE-2026-6300Use after free in CSS in Google Chrome prior to 147.0.7727.1…8.8
• CVE-2026-63000REDAXO is a PHP-based content management system. Prior to 5.…6.4
• CVE-2026-63001REDAXO is a PHP-based content management system. Prior to 5.…4.8
• CVE-2026-63003django CMS is an easy-to-use and developer-friendly enterpri…6.5
• CVE-2026-63004Unleash is an open-source feature management platform. Prior…5.5
• CVE-2026-63006Zammad is a web based open source helpdesk/customer support …5.3
• CVE-2026-6301Type Confusion in Turbofan in Google Chrome prior to 147.0.7…8.8
• CVE-2026-63015Uncontrolled Resource Consumption vulnerability in Apache In…4.3
• CVE-2026-63016Uncontrolled Resource Consumption vulnerability in Apache In…5.3