REDAXO CMS CVE-2026-63002

Exploitation requires two chained prerequisites: (1) the attacker must be able to place a file with an HTML-metacharacter filename into the REDAXO /media filesystem directory without registering it in the media database - per the advisory this needs admin-level backup restore or direct server/filesystem access; and (2) a backend user holding the media[sync] permission must then navigate to Mediapool → Sync to trigger the stored payload (required user interaction, UI:R). Exploitation is limited to REDAXO core <= 5.21.1; it is not remotely exploitable against a default configuration by an unauthenticated external attacker, since the file-placement step demands high privilege or server access.

This is a genuine but low-to-moderate priority issue, correctly rated LOW (CVSS 4.8). The provided CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N) is internally consistent and defensible: although the XSS payload delivery is network-facing, actually planting the malicious filename in the /media filesystem directory requires high privilege (admin-level backup restore or direct server access), which justifies PR:H, and a backend victim must load the sync page (UI:R). No EPSS score, no CISA KEV listing, and no independent POC/exploit-code signal are present in the input - only the vendor advisory's step-by-step reproduction. The realistic risk is therefore constrained by the strong precondition: an attacker who can already write arbitrary files to /media typically already possesses significant access, making this more of a privilege-escalation/lateral-movement primitive (low-priv media[sync] operator → admin session theft) than a remote-unauthenticated threat. No conflicting signals of note; the vendor vector and description agree. Verify EPSS/POC status externally as neither is supplied.

An attacker with the ability to write files to the REDAXO /media directory (via an admin-level backup restore or server/FTP access) places a file named like <img src=x onerror=alert(document.cookie)>.txt that is not yet registered in the media database. When any backend user with the media[sync] permission opens Mediapool → Sync, the unescaped filename executes JavaScript in their session, enabling cookie/session theft against higher-privileged admins. The vendor advisory documents a working reproduction, though no separate weaponized exploit code is referenced.