Vulnerability · Published Jan 7, 2026 · Assigned by GitHub_M
CVE-2026-21857Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
High 8.3
In plain English
A high-severity path traversal in redaxo from redaxo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.
Official description
REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | redaxo/source | 5.20.2 | GHSA-824x-88xg-cwrv |
Affected products (as reported)
Weakness: CWE-24, CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N
References
- https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv x_refsource_CONFIRM
- https://github.com/redaxo/redaxo/releases/tag/5.20.2 x_refsource_MISC