CVE-2026-63002: REDAXO stored XSS in Mediapool Sync page via unescaped filenames

CVE-2026-63002 · Severity: medium · CVSS 4.8 · Published 2026-09-23

REDAXO's media file synchronization page displays filesystem filenames without proper HTML escaping, allowing arbitrary JavaScript execution in the browsers of backend users who have permission to access the sync feature. An attacker with the ability to place files on the server (via backup restore or direct filesystem access) can craft malicious filenames that execute code and steal admin session cookies, leading to complete CMS compromise.

Technologies: redaxo/source (Packagist), REDAXO. Vendors: Packagist, REDAXO.

Quick answers

Is CVE-2026-63002 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63002 being exploited in the wild.
How severe is CVE-2026-63002?
Medium severity, with a CVSS score of 4.8, published 23 September 2026.
Which products and versions are affected?
redaxo/source (Packagist) <= 5.21.1, ECOSYSTEM:introduced=0,fixed=5.21.2.
Is there a fix for CVE-2026-63002?
Yes. redaxo/source (Packagist): upgrade to 5.21.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63002 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-63002?
Check whether you run redaxo/source (Packagist) or REDAXO at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • redaxo/source (Packagist): upgrade to 5.21.2 or later
    composer require redaxo/source:^5.21.2

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the Mediapool sync.php page. The root cause is that filenames from the `/media/` filesystem directory are rendered directly into HTML without calling `rex_escape()` (equivalent to htmlspecialchars) before insertion into label and input elements. The attack requires an attacker to first place a file with HTML metacharacters in the filename (e.g., `&lt;img src=x onerror=alert(document.cookie)&gt;.txt`) into the `/media/` directory, which is possible with admin-level access such as via backup restore or direct server access. When any backend user with the `media[sync]` permission navigates to the sync page, the malicious filename is rendered and the JavaScript payload executes in their browser context. The vulnerability enables session hijacking and credential theft of any user who views the page. The fix involves applying `rex_escape()` to all filename variables before HTML insertion.

Affected products

  • REDAXO REDAXO

Identifiers

  • CVE-2026-63002
  • GHSA-w998-qmw9-mf4m

Timeline

  • 2026-09-23: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.