REDAXO EUVD-2026-110798

Requires an authenticated REDAXO backend account holding mediapool upload or edit rights (administrator not required). The SVG extension must be permitted - svg is not in the mediapool's default blocked_extensions, so default installs are exposed. Exploitation then needs one of two conditions: (1) winning a short race by requesting the public .svg URL during the single-digit-millisecond sanitization window (explicitly unreliable, requiring high-frequency timed requests), or (2) causing sanitizeMedia()'s full-DOM parse to exceed the request's memory_limit or max_execution_time so the request dies after the move, leaving the unsanitized SVG permanently public (no timing needed, but dependent on server resource limits and file size). Successful script execution additionally requires a victim backend user to open the raw .svg URL as a top-level navigation or via iframe, and a single-domain deployment where /media/ shares the backend origin. Limiting factors: required authentication with upload rights, required victim interaction, and the configuration-dependent sanitizer-failure condition - all of which substantially constrain real-world exploitability.

All decision signals converge on LOW real-world priority. The vendor/input CVSS 4.0 base score is 2.1, the vuln.today Decision label is 'monitor', and the CISA SSVC framework records Exploitation: none, Automatable: no, Technical Impact: partial. The CVSS vector itself raises the exploitation bar on multiple axes: PR:L (an authenticated backend account with mediapool rights is required), UI:P (a victim must be induced to open the raw file), and AC:H/AT:P (a specific, attacker-uncontrolled condition must hold). The source-code evidence confirms this: the 'race the sanitizer' path is explicitly described as unreliable with a single-digit-millisecond window requiring high-frequency timed requests, while the more dependable 'sanitization never completes' path depends on the upload exceeding the request's memory_limit/max_execution_time - a server-configuration-dependent condition, not something the attacker fully controls. Impact is limited to C:L/I:L (partial) - stored XSS in a backend session on typical single-domain installs. No CISA KEV listing and SSVC Exploitation: none mean there is no evidence of active exploitation; no public exploit identified at time of analysis. EPSS is not provided in the input, so probabilistic exploitation likelihood cannot be cited. Net: a genuine but low-severity, authenticated, conditions-dependent issue - patch during normal maintenance, not an emergency.

A logged-in REDAXO backend user who only holds mediapool upload/edit rights (not an administrator) uploads an SVG containing a <script> element. Because the file is moved into the public /media/ folder before the SVG sanitizer runs, the raw unsanitized file is briefly (or, if sanitization never completes due to memory/time limits, permanently) served from its public URL. The attacker then lures another backend user to open that raw .svg URL as a top-level navigation or in an iframe, and because /media/ shares the backend origin on single-domain installs, the script executes in the victim's authenticated backend session. No public exploit identified at time of analysis.