REDAXO core versions before 5.21.2 contain an XSS vulnerability in redaxo/src/addons/mediapool/pages/sync.php. The code inserts filenames from the media filesystem into the Mediapool Sync page without applying rex_escape(), allowing an attacker who can place a crafted file with HTML metacharacters in the media directory to execute arbitrary scripts in the context of backend users with media[sync] permission. This can enable session theft or unauthorized actions in the backend. The issue is resolved in version 5.21.2 by properly escaping these inputs.

Successful exploitation allows an attacker to execute arbitrary scripts in the browser of authorized backend users with media[sync] permission. This can lead to session theft or unauthorized backend operations, compromising the integrity and confidentiality of the backend environment. The vulnerability requires the attacker to place a malicious file in the media directory and the victim to open the Sync page, which involves user interaction.

A fix is available in REDAXO version 5.21.2. Users should upgrade to version 5.21.2 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.