CVE-2019-13493: In Sitecore 9.0 rev 171002, Persistent XSS exists in the Media Library and File Manager.

Security readout for executives and security teams

This issue lets a logged-in low-privilege Sitecore user store JavaScript through file extension handling in the Media Library and File Manager. If another CMS user views the affected content, the script may run in their browser. Sources do not provide severity scoring, official fixes, or evidence of active exploitation. Exposure is most likely in organizations running Sitecore 9.0 rev 171002 where non-admin authenticated users can upload or manage files through Media Library or File Manager. Prioritize remediation if affected Sitecore instances are production-facing, business-critical, or allow broad CMS user access. Treat as moderate until vendor-specific severity and fix status are confirmed. Mitigation focus: Inventory Sitecore deployments and identify any 9.0 rev 171002 instances.; Check Sitecore vendor guidance for applicable patches, hotfixes, or supported upgrades.; Restrict Media Library and File Manager access to trusted users only..

Prepared

Jun 6, 2026, 20:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.