{“lastseen”:”2026-04-13T15:32:44″,”description”:”Redaxo versions 5.20.1 and below suffer from a path traversal vulnerability…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Redaxo 5.20.1 Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:218731″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-21857″],”sourceData”:”# CVE-2026-21857: Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read\\n \\n ## Overview\\n \\n | Field | Details |\\n |—|—|\\n | **CVE ID** | [CVE-2026-21857](https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-21857) |\\n | **Severity** | HIGH |\\n | **Advisory** | [View Advisory](https:\/\/github.com\/redaxo\/redaxo\/security\/advisories\/GHSA-824x-88xg-cwrv) |\\n | **Discovered by** | [Lukasz Rybak](https:\/\/github.com\/lukasz-rybak) |\\n \\n ## Affected Products\\n \\n – **redaxo\/source** (versions: \\u003c= 5.20.1)\\n \\n \\n ## CWE Classification\\n \\n – CWE-22: Improper Limitation of a Pathname to a Restricted Directory (‘Path Traversal’)\\n – CWE-24: Path Traversal: ‘..\/filedir’\\n \\n ## Details\\n \\n ### Summary\\n Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon’s file export functionality.\\n \\u003cimg width=\\”664\\” height=\\”899\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/fd1ca69e-b275-4daf-9a62-621cde6525f5\\” \/\\u003e\\n \\u003cimg width=\\”2358\\” height=\\”445\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/fad81152-9e1b-413e-9823-09540a23e2fb\\” \/\\u003e\\n \\n \\n ### Details\\n The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. \\n An attacker can supply relative paths containing `..\/` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive.\\n \\n Vulnerable code:\\n – `redaxo\/src\/addons\/backup\/pages\/export.php` (lines 72-76) \u2013 directly uses `$_POST[‘EXPDIR’]`\\n – `redaxo\/src\/addons\/backup\/lib\/backup.php` (lines ~413 \\u0026 ~427) \u2013 concatenates unsanitized user input with base path\\n \\n This allows disclosure of sensitive files such as:\\n – `redaxo\/data\/core\/config.yml` \u2192 database credentials + password hashes of all backend users\\n – `.env`, custom configuration files, logs, uploaded malicious files, etc.\\n \\n ### Affected versions\\n \u2264 5.20.1 (confirmed working)\\n \\n ### Patched versions\\n None (as of 2025-12-09)\\n \\n ### PoC \u2013 Extracting database credentials and password hashes\\n 1. Log in as any user with Backup permission\\n 2. Go to Backup \u2192 Export \u2192 Files\\n \\n \\u003cimg width=\\”1240\\” height=\\”960\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/bc05ba18-9664-4be2-b637-4fec3a0f409a\\” \/\\u003e\\n \\n 3. Intercept the request with Burp Suite \\n \\n \\u003cimg width=\\”2184\\” height=\\”478\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/9fa754a1-2cd0-4d3d-a5cc-cfa34c8a1718\\” \/\\u003e\\n \\n 4. Change one `EXPDIR[]` value to `..\/..\/..\/..\/var\/www\/html\/redaxo\/data\/core`\\n \\n \\u003cimg width=\\”978\\” height=\\”591\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/d15f5c7f-b72c-44cc-9be2-da8d3f26f124\\” \/\\u003e\\n \\n 5. Send request \u2192 download archive\\n \\u003cimg width=\\”423\\” height=\\”131\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/db8a8bda-cdaf-4dea-812f-1e312da908e2\\” \/\\u003e\\n \\n 6. Extract and open `data\/core\/config.yml`\\n \\u003cimg width=\\”859\\” height=\\”281\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/c8112ce1-5a1d-435f-953b-7eb4e711e042\\” \/\\u003e\\n \\n Result: plaintext database password \\n \\u003cimg width=\\”2534\\” height=\\”1198\\” alt=\\”image\\” src=\\”https:\/\/github.com\/user-attachments\/assets\/218ae917-868a-437e-98b0-6471b82c0b10\\” \/\\u003e\\n \\n ### Impact\\n Full compromise of the REDAXO installation:\\n – Database takeover\\n – Password hash extraction \u2192 offline cracking \u2192 admin access\\n – When combined with other vulnerabilities \u2192 RCE\\n \\n CVSS 4.0 vector \\u0026 score below.\\n \\n ### Credits\\n Discovered by: \u0141ukasz Rybak\\n \\n ## References\\n \\n – https:\/\/github.com\/redaxo\/redaxo\/security\/advisories\/GHSA-824x-88xg-cwrv\\n – https:\/\/github.com\/redaxo\/redaxo\/releases\/tag\/5.20.2\\n – https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2026-21857\\n – https:\/\/github.com\/advisories\/GHSA-824x-88xg-cwrv\\n \\n \\n ## Disclaimer\\n \\n This CVE was responsibly disclosed following coordinated vulnerability disclosure practices. The information provided here is for educational and defensive purposes only.”,”sourceHref”:”https:\/\/packetstorm.news\/download\/218731″,”cvss”:{“score”:8.3,”severity”:”HIGH”,”vector”:”CVSS:4.0\/AV:N\/AC:L\/AT:N\/PR:H\/UI:N\/VC:H\/SC:H\/VI:N\/SI:H\/VA:N\/SA:N”,”version”:”4.0″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:”https:\/\/packetstorm.news\/files\/id\/218731\/”,”category_name”:”Exploit”,”post_link”:””,”product”:””,”version”:””,”vendor”:””,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:”2026-04-13T15:32:44″,”description”:”Redaxo versions 5.20.1 and below suffer from a path traversal vulnerability…”,”published”:”2026-04-13T00:00:00″,”modified”:”2026-04-13T00:00:00″,”type”:”packetstorm”,”title”:”\ud83d\udcc4 Redaxo 5.20.1 Path Traversal”,”source”:””,”references”:””,”id”:”PACKETSTORM:218731″,”bulletinFamily”:”exploit”,”cwe”:null,”cvelist”:[“CVE-2026-21857″],”sourceData”:”# CVE-2026-21857: Redaxo has Path Traversal in Backup Addon Leading to…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[6,8,99,12,15,13,53,7,11,5],"class_list":["post-46323","post","type-post","status-publish","format-standard","hentry","category-category_exploit","tag-cve","tag-cvss","tag-cvss-83","tag-exploit","tag-high","tag-news","tag-packetstorm","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n