[MEDIUM] REDAXO: Stored XSS in Mediapool Sync Page via Unescaped Filesystem Filenames

PKSA-hw96-c37g-vqkw CVE-2026-63002 GHSA-w998-qmw9-mf4m

Affected package: redaxo/source

Affected version: <=5.21.1

Reported by:
GitHub