{"id":"CVE-2026-21857","aliases":["GHSA-824x-88xg-cwrv"],"url":"https://o3.security/vulnerability/CVE-2026-21857","summary":"Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read","details":"### Summary\nAuthenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality.\n<img width=\"664\" height=\"899\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5\" />\n<img width=\"2358\" height=\"445\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb\" />\n\n\n### Details\nThe Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories.  \nAn attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive.\n\nVulnerable code:\n- `redaxo/src/addons/backup/pages/export.php` (lines 72-76) – directly uses `$_POST['EXPDIR']`\n- `redaxo/src/addons/backup/lib/backup.php` (lines ~413 & ~427) – concatenates unsanitized user input with base path\n\nThis allows disclosure of sensitive files such as:\n- `redaxo/data/core/config.yml` → database credentials + password hashes of all backend users\n- `.env`, custom configuration files, logs, uploaded malicious files, etc.\n\n### Affected versions\n≤ 5.20.1 (confirmed working)\n\n### Patched versions\nNone (as of 2025-12-09)\n\n### PoC – Extracting database credentials and password hashes\n1. Log in as any user with Backup permission\n2. Go to Backup → Export → Files\n\n<img width=\"1240\" height=\"960\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bc05ba18-9664-4be2-b637-4fec3a0f409a\" />\n\n3. Intercept the request with Burp Suite \n\n<img width=\"2184\" height=\"478\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9fa754a1-2cd0-4d3d-a5cc-cfa34c8a1718\" />\n\n4. Change one `EXPDIR[]` value to `../../../../var/www/html/redaxo/data/core`\n\n<img width=\"978\" height=\"591\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d15f5c7f-b72c-44cc-9be2-da8d3f26f124\" />\n\n5. Send request → download archive\n<img width=\"423\" height=\"131\" alt=\"image\" src=\"https://github.com/user-attachments/assets/db8a8bda-cdaf-4dea-812f-1e312da908e2\" />\n\n6. Extract and open `data/core/config.yml`\n<img width=\"859\" height=\"281\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c8112ce1-5a1d-435f-953b-7eb4e711e042\" />\n\nResult: plaintext database password \n<img width=\"2534\" height=\"1198\" alt=\"image\" src=\"https://github.com/user-attachments/assets/218ae917-868a-437e-98b0-6471b82c0b10\" />\n\n### Impact\nFull compromise of the REDAXO installation:\n- Database takeover\n- Password hash extraction → offline cracking → admin access\n- When combined with other vulnerabilities → RCE\n\nCVSS 4.0 vector & score below.\n\n### Credits\nDiscovered by: Łukasz Rybak","published":"2026-01-07T22:32:15.859Z","modified":"2026-10-28T02:30:27.273355613Z","cvss":null,"epss":{"score":0.00501,"percentile":0.40937,"asOf":"2026-08-21"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"redaxo/source","fixedVersion":"5.20.2"}],"fix":null,"references":[{"type":"WEB","url":"https://github.com/redaxo/redaxo/releases/tag/5.20.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21857.json"},{"type":"ADVISORY","url":"https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-21857"},{"type":"PACKAGE","url":"https://github.com/redaxo/redaxo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T02:30:27.273355613Z"}}