📄 Redaxo 5.20.1 Path Traversal_PACKETSTORM:218731

{
    "lastseen": "2026-04-13T15:32:44",
    "description": "Redaxo versions 5.20.1 and below suffer from a path traversal vulnerability...",
    "published": "2026-04-13T00:00:00",
    "modified": "2026-04-13T00:00:00",
    "type": "packetstorm",
    "title": "\ud83d\udcc4 Redaxo 5.20.1 Path Traversal",
    "source": "",
    "references": "",
    "id": "PACKETSTORM:218731",
    "bulletinFamily": "exploit",
    "cwe": null,
    "cvelist": [
        "CVE-2026-21857"
    ],
    "sourceData": "# CVE-2026-21857: Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read\n    \n    ## Overview\n    \n    | Field | Details |\n    |---|---|\n    | **CVE ID** | [CVE-2026-21857](https://nvd.nist.gov/vuln/detail/CVE-2026-21857) |\n    | **Severity** | HIGH |\n    | **Advisory** | [View Advisory](https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv) |\n    | **Discovered by** | [Lukasz Rybak](https://github.com/lukasz-rybak) |\n    \n    ## Affected Products\n    \n    - **redaxo/source** (versions: <= 5.20.1)\n    \n    \n    ## CWE Classification\n    \n    - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')\n    - CWE-24: Path Traversal: '../filedir'\n    \n    ## Details\n    \n    ### Summary\n    Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality.\n    <img width=\"664\" height=\"899\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5\" />\n    <img width=\"2358\" height=\"445\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb\" />\n    \n    \n    ### Details\n    The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories.  \n    An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive.\n    \n    Vulnerable code:\n    - `redaxo/src/addons/backup/pages/export.php` (lines 72-76) \u2013 directly uses `$_POST['EXPDIR']`\n    - `redaxo/src/addons/backup/lib/backup.php` (lines ~413 & ~427) \u2013 concatenates unsanitized user input with base path\n    \n    This allows disclosure of sensitive files such as:\n    - `redaxo/data/core/config.yml` \u2192 database credentials + password hashes of all backend users\n    - `.env`, custom configuration files, logs, uploaded malicious files, etc.\n    \n    ### Affected versions\n    \u2264 5.20.1 (confirmed working)\n    \n    ### Patched versions\n    None (as of 2025-12-09)\n    \n    ### PoC \u2013 Extracting database credentials and password hashes\n    1. Log in as any user with Backup permission\n    2. Go to Backup \u2192 Export \u2192 Files\n    \n    <img width=\"1240\" height=\"960\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bc05ba18-9664-4be2-b637-4fec3a0f409a\" />\n    \n    3. Intercept the request with Burp Suite \n    \n    <img width=\"2184\" height=\"478\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9fa754a1-2cd0-4d3d-a5cc-cfa34c8a1718\" />\n    \n    4. Change one `EXPDIR[]` value to `../../../../var/www/html/redaxo/data/core`\n    \n    <img width=\"978\" height=\"591\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d15f5c7f-b72c-44cc-9be2-da8d3f26f124\" />\n    \n    5. Send request \u2192 download archive\n    <img width=\"423\" height=\"131\" alt=\"image\" src=\"https://github.com/user-attachments/assets/db8a8bda-cdaf-4dea-812f-1e312da908e2\" />\n    \n    6. Extract and open `data/core/config.yml`\n    <img width=\"859\" height=\"281\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c8112ce1-5a1d-435f-953b-7eb4e711e042\" />\n    \n    Result: plaintext database password \n    <img width=\"2534\" height=\"1198\" alt=\"image\" src=\"https://github.com/user-attachments/assets/218ae917-868a-437e-98b0-6471b82c0b10\" />\n    \n    ### Impact\n    Full compromise of the REDAXO installation:\n    - Database takeover\n    - Password hash extraction \u2192 offline cracking \u2192 admin access\n    - When combined with other vulnerabilities \u2192 RCE\n    \n    CVSS 4.0 vector & score below.\n    \n    ### Credits\n    Discovered by: \u0141ukasz Rybak\n    \n    ## References\n    \n    - https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv\n    - https://github.com/redaxo/redaxo/releases/tag/5.20.2\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-21857\n    - https://github.com/advisories/GHSA-824x-88xg-cwrv\n    \n    \n    ## Disclaimer\n    \n    This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.",
    "sourceHref": "https://packetstorm.news/download/218731",
    "cvss": {
        "score": 8.3,
        "severity": "HIGH",
        "vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/SC:H/VI:N/SI:H/VA:N/SA:N",
        "version": "4.0"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "https://packetstorm.news/files/id/218731/",
    "category_name": "Exploit",
    "post_link": "",
    "product": "",
    "version": "",
    "vendor": "",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}