Threats tagged 'ghsa-7mw4-9872-fvq7'

REDAXO versions from 5.18.0 up to but not including 5.21.4 contain a stored cross-site scripting (XSS) vulnerability. This occurs because the rex_media_service component moves uploaded SVG files into the public media folder before sanitizing them. Authenticated users with mediapool upload rights can exploit a race condition or exhaust memory limits to leave malicious script-laden SVG files accessible, leading to script execution in victims' backend sessions.