Executive brief
REDAXO's media file synchronization page displays filesystem filenames without proper HTML escaping, allowing arbitrary JavaScript execution in the browsers of backend users who have permission to access the sync feature. An attacker with the ability to place files on the server (via backup restore or direct filesystem access) can craft malicious filenames that execute code and steal admin session cookies, leading to complete CMS compromise.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Mediapool sync.php page. The root cause is that filenames from the `/media/` filesystem directory are rendered directly into HTML without calling `rex_escape()` (equivalent to htmlspecialchars) before insertion into label and input elements. The attack requires an attacker to first place a file with HTML metacharacters in the filename (e.g., `<img src=x onerror=alert(document.cookie)>.txt`) into the `/media/` directory, which is possible with admin-level access such as via backup restore or direct server access. When any backend user with the `media[sync]` permission navigates to the sync page, the malicious filename is rendered and the JavaScript payload executes in their browser context. The vulnerability enables session hijacking and credential theft of any user who views the page. The fix involves applying `rex_escape()` to all filename variables before HTML insertion.
Affected products
- REDAXO REDAXO
Timeline
- 2026-09-23: disclosed