https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 12:39:33 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-63002 <p>REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.</p> <p>REDAXO is a PHP-based content management system. Prior to 5.21.2, redaxo/src/addons/mediapool/pages/sync.php inserts filenames held in $diffFiles from the media filesystem into the Mediapool Sync page without rex_escape(). An attacker who can place an unregistered file with HTML metacharacters in the media directory can execute script in the browser of a backend user with media[sync] permission when that user opens the Sync page, enabling session theft or unauthorized backend actions. This issue is fixed in version 5.21.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-63002 https://vulnerability.circl.lu/vuln/ghsa-w998-qmw9-mf4m <p><strong>Affected:</strong> Packagist: redaxo/source</p> <p>### Summary The mediapool sync page (`sync.php`) renders filenames from the `/media` filesystem directory directly into HTML without applying `rex_escape()` (i.e., `htmlspecialchars`). Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any backend user who views the sync page.</p> <p>### Details In `redaxo/src/addons/mediapool/pages/sync.php`, the variable `$diffFiles` is populated from actual filesystem filenames (files in `/media/` not yet registered in the database). These filenames are then rendered without escaping:</p> <p>**File:** `redaxo/src/addons/mediapool/pages/sync.php:119-120` ```php foreach ($diffFiles as $file) { if (is_writable(rex_path::media($file))) { $e = []; $e[&#39;label&#39;] = &#39;&lt;label&gt;&#39; . $file . &#39;&lt;/label&gt;&#39;; // NO rex_escape! $e[&#39;field&#39;] = &#39;&lt;input type=&#34;checkbox&#34; name=&#34;sync_files[]&#34; value=&#34;&#39; . $file . &#39;&#34; /&gt;&#39;; // NO rex_escape! $writable[] = $e; } else { $notWritable[] = $file; } } ```</p> <p>**File:** `redaxo/src/addons/mediapool/pages/sync.php:170` ```php $fragment-&gt;setVar(&#39;body&#39;, &#39;&lt;ul&gt;&lt;li&gt;&#39; . implode(&#39;&lt;/li&gt;&lt;li&gt;&#39;, $notWritable) . &#39;&lt;/li&gt;&lt;/ul&gt;&#39;, false); // $notWritable contains unescaped filenames ```</p> <p>By contrast, all other filename displays in the codebase use `rex_escape($fname)` (e.g., `media.detail.php:236`, `media.list.php`). The sync page is accessible to any backend user with the `media[sync]` permission (not exclusively admins).</p> <p>### Po…</p> <p><strong>Affected:</strong> Packagist: redaxo/source</p> <p>### Summary The mediapool sync page (`sync.php`) renders filenames from the `/media` filesystem directory directly into HTML without applying `rex_escape()` (i.e., `htmlspecialchars`). Any file placed in the media directory whose filename contains HTML metacharacters will execute JavaScript in the browser of any backend user who views the sync page.</p> <p>### Details In `redaxo/src/addons/mediapool/pages/sync.php`, the variable `$diffFiles` is populated from actual filesystem filenames (files in `/media/` not yet registered in the database). These filenames are then rendered without escaping:</p> <p>**File:** `redaxo/src/addons/mediapool/pages/sync.php:119-120` ```php foreach ($diffFiles as $file) { if (is_writable(rex_path::media($file))) { $e = []; $e[&#39;label&#39;] = &#39;&lt;label&gt;&#39; . $file . &#39;&lt;/label&gt;&#39;; // NO rex_escape! $e[&#39;field&#39;] = &#39;&lt;input type=&#34;checkbox&#34; name=&#34;sync_files[]&#34; value=&#34;&#39; . $file . &#39;&#34; /&gt;&#39;; // NO rex_escape! $writable[] = $e; } else { $notWritable[] = $file; } } ```</p> <p>**File:** `redaxo/src/addons/mediapool/pages/sync.php:170` ```php $fragment-&gt;setVar(&#39;body&#39;, &#39;&lt;ul&gt;&lt;li&gt;&#39; . implode(&#39;&lt;/li&gt;&lt;li&gt;&#39;, $notWritable) . &#39;&lt;/li&gt;&lt;/ul&gt;&#39;, false); // $notWritable contains unescaped filenames ```</p> <p>By contrast, all other filename displays in the codebase use `rex_escape($fname)` (e.g., `media.detail.php:236`, `media.list.php`). The sync page is accessible to any backend user with the `media[sync]` permission (not exclusively admins).</p> <p>### Po…</p> https://vulnerability.circl.lu/vuln/ghsa-w998-qmw9-mf4m