An attacker who can place a file with HTML‑containing characters in the media directory can exploit a flaw in REDAXO that fails to escape those filenames when rendering the Mediapool Sync page. The injected script runs in the browser of any backend user with media[sync] permission who visits the page, enabling the attacker to steal the user’s session or perform unauthorized actions within the CMS.

This vulnerability is present in REDAXO core versions prior to release 5.21.2, affecting the sync.php page of the mediapool add‑on within the redaxo:core product. Only installations that have the media directory writable and include users with media[sync] permission are impacted.

With a CVSS score of 4.8 the issue is considered moderate severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to successfully place a specially crafted file into the media folder and a target user with media[sync] access to view the Sync page, making it an privileged‑user or internal attack vector rather than a remote, unauthenticated one.