This vulnerability allows an authenticated user with mediapool upload privileges to upload SVG files that are not sanitized before being saved to a public directory. By timing the upload against the sanitization process or exhausting memory, the attacker can place maliciously crafted SVG files into the public media folder, where they are served to other authenticated users. The embedded scripts will then execute within the victim’s backend session, potentially compromising session cookies or performing further malicious activity.

Redaxo Core versions from 5.18.0 up to, but not including, 5.21.4 are affected. Users running any of these releases with the ability to upload SVG files to the mediapool are at risk.

The CVSS score of 2.1 indicates low severity, and EPSS data is not available. The vulnerability is not listed in CISA’s KEV catalog. The attack requires an authenticated user with uploading rights and relies on a race condition or memory exhaustion; thus the likelihood is limited to environments where such permissions exist and the sanitization delay can be exploited. Nonetheless, successful exploitation results in the execution of arbitrary scripts in the backend of the victim, which can lead to data theft or session hijacking within the CMS.