{
  "affected": [
    {
      "affectedData": [
        {
          "product": "core",
          "vendor": "redaxo",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 5.21.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2."
    }
  ],
  "id": "CVE-2026-63002",
  "lastModified": "2026-09-23T15:17:15.770",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 4.8,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "privilegesRequired": "HIGH",
          "scope": "CHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 1.7,
        "impactScore": 2.7,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-09-23T15:17:15.770",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/redaxo/core/pull/6581"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Primary"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.21.1"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "redaxo/source"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.21.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63002"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-79"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-23T14:06:04Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "### Summary\nThe mediapool sync page (`sync.php`) renders filenames from the `/media` filesystem directory directly into HTML without applying `rex_escape()` (i.e., `htmlspecialchars`). Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any backend user who views the sync page.\n\n### Details\nIn `redaxo/src/addons/mediapool/pages/sync.php`, the variable `$diffFiles` is populated from actual filesystem filenames (files in `/media/` not yet registered in the database). These filenames are then rendered without escaping:\n\n**File:** `redaxo/src/addons/mediapool/pages/sync.php:119-120`\n```php\nforeach ($diffFiles as $file) {\n    if (is_writable(rex_path::media($file))) {\n        $e = [];\n        $e[\u0027label\u0027] = \u0027\u003clabel\u003e\u0027 . $file . \u0027\u003c/label\u003e\u0027;          // NO rex_escape!\n        $e[\u0027field\u0027] = \u0027\u003cinput type=\"checkbox\" name=\"sync_files[]\" value=\"\u0027 . $file . \u0027\" /\u003e\u0027; // NO rex_escape!\n        $writable[] = $e;\n    } else {\n        $notWritable[] = $file;\n    }\n}\n```\n\n**File:** `redaxo/src/addons/mediapool/pages/sync.php:170`\n```php\n$fragment-\u003esetVar(\u0027body\u0027, \u0027\u003cul\u003e\u003cli\u003e\u0027 . implode(\u0027\u003c/li\u003e\u003cli\u003e\u0027, $notWritable) . \u0027\u003c/li\u003e\u003c/ul\u003e\u0027, false);\n// $notWritable contains unescaped filenames\n```\n\nBy contrast, all other filename displays in the codebase use `rex_escape($fname)` (e.g., `media.detail.php:236`, `media.list.php`). The sync page is accessible to any backend user with the `media[sync]` permission (not exclusively admins).\n\n### PoC\n1. Place a file named `\u003cimg src=x onerror=alert(document.cookie)\u003e.txt` into the REDAXO `/media/` directory (via backup restore or server access) without adding it to the media database.\n2. Log in as any backend user with `media[sync]` permission.\n3. Navigate to **Mediapool \u2192 Sync**.\n4. The XSS payload executes immediately, stealing the admin session cookie.\n\n### Impact\nStored XSS in the admin panel. An attacker who can place files in the media directory (via admin-level backup restore or server access) can achieve persistent XSS against all users who visit the sync page, including higher-privileged admins. This enables session hijacking, credential theft, and full CMS takeover.\n\n### Fix\nApply `rex_escape()` to all filename variables before inserting into HTML:\n```php\n$e[\u0027label\u0027] = \u0027\u003clabel\u003e\u0027 . rex_escape($file) . \u0027\u003c/label\u003e\u0027;\n$e[\u0027field\u0027] = \u0027\u003cinput type=\"checkbox\" name=\"sync_files[]\" value=\"\u0027 . rex_escape($file) . \u0027\" /\u003e\u0027;\n// ...\n$fragment-\u003esetVar(\u0027body\u0027, \u0027\u003cul\u003e\u003cli\u003e\u0027 . implode(\u0027\u003c/li\u003e\u003cli\u003e\u0027, array_map(\u0027rex_escape\u0027, $notWritable)) . \u0027\u003c/li\u003e\u003c/ul\u003e\u0027, false);\n```",
  "id": "GHSA-w998-qmw9-mf4m",
  "modified": "2026-09-23T14:06:04Z",
  "published": "2026-09-23T14:06:04Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/security/advisories/GHSA-w998-qmw9-mf4m"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/pull/6581"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/commit/2daaa3a30570bc76a82f63fd21fb8c9c2cd5dc7c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/redaxo/core"
    },
    {
      "type": "WEB",
      "url": "https://github.com/redaxo/core/releases/tag/5.21.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames"
}