CVE-2026-21857: Redaxo/source Path Traversal Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-824x-88xg-cwrv",
  "modified" : "2026-01-08T20:07:42Z",
  "published" : "2026-01-05T20:02:58Z",
  "aliases" : [ "CVE-2026-21857" ],
  "summary" : "Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read",
  "details" : "### Summary\nAuthenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality.\n<img width=\"664\" height=\"899\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5\" />\n<img width=\"2358\" height=\"445\" alt=\"image\" src=\"https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb\" />\n\n\n### Details\nThe Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories.  \nAn attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive.\n\nVulnerable code:\n- `redaxo/src/addons/backup/pages/export.php` (lines 72-76) – directly uses `$_POST['EXPDIR']`\n- `redaxo/src/addons/backup/lib/backup.php` (lines ~413 & ~427) – concatenates unsanitized user input with base path\n\nThis allows disclosure of sensitive files such as:\n- `redaxo/data/core/config.yml` → database credentials + password hashes of all backend users\n- `.env`, custom configuration files, logs, uploaded malicious files, etc.\n\n### Affected versions\n≤ 5.20.1 (confirmed working)\n\n### Patched versions\nNone (as of 2025-12-09)\n\n### PoC – Extracting database credentials and password hashes\n1. Log in as any user with Backup permission\n2. Go to Backup → Export → Files\n\n<img width=\"1240\" height=\"960\" alt=\"image\" src=\"https://github.com/user-attachments/assets/bc05ba18-9664-4be2-b637-4fec3a0f409a\" />\n\n3. Intercept the request with Burp Suite \n\n<img width=\"2184\" height=\"478\" alt=\"image\" src=\"https://github.com/user-attachments/assets/9fa754a1-2cd0-4d3d-a5cc-cfa34c8a1718\" />\n\n4. Change one `EXPDIR[]` value to `../../../../var/www/html/redaxo/data/core`\n\n<img width=\"978\" height=\"591\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d15f5c7f-b72c-44cc-9be2-da8d3f26f124\" />\n\n5. Send request → download archive\n<img width=\"423\" height=\"131\" alt=\"image\" src=\"https://github.com/user-attachments/assets/db8a8bda-cdaf-4dea-812f-1e312da908e2\" />\n\n6. Extract and open `data/core/config.yml`\n<img width=\"859\" height=\"281\" alt=\"image\" src=\"https://github.com/user-attachments/assets/c8112ce1-5a1d-435f-953b-7eb4e711e042\" />\n\nResult: plaintext database password \n<img width=\"2534\" height=\"1198\" alt=\"image\" src=\"https://github.com/user-attachments/assets/218ae917-868a-437e-98b0-6471b82c0b10\" />\n\n### Impact\nFull compromise of the REDAXO installation:\n- Database takeover\n- Password hash extraction → offline cracking → admin access\n- When combined with other vulnerabilities → RCE\n\nCVSS 4.0 vector & score below.\n\n### Credits\nDiscovered by: Łukasz Rybak",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "redaxo/source"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "5.20.2"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 5.20.1"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-21857"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/redaxo/redaxo"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/redaxo/redaxo/releases/tag/5.20.2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-22", "CWE-24" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-01-05T20:02:58Z",
    "nvd_published_at" : "2026-01-07T23:15:50Z"
  }
}