HIGH🇵🇱 Wersja polska

CVE-2026-21857

CVSS 8.3v4.0pub. 2026-01-07upd. 2026-01-20

REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.

CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

  • Redaxo

    APP
    Redaxo
    < 5.20.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Path Traversal
CWE
References

Related vulnerabilities

CVE-2018-18200CRITICAL9.8PL ✓same product

SQL injection w module Benutzerverwaltung systemu REDAXO CMS

CVE-2018-17831CRITICAL9.8PL ✓same product

SQL injection w REDAXO CMS — parametr sort w klasie rex_list

CVE-2025-64050HIGH7.2same product

A Remote Code Execution (RCE) vulnerability in the template management component in REDAXO CMS 5.20.0 allows r...

CVE-2024-46210HIGH7.2same product

An arbitrary file upload vulnerability in the MediaPool module of Redaxo CMS v5.17.1 allows attackers to execu...

CVE-2024-46213HIGH7.2same product

REDAXO CMS v2.11.0 was discovered to contain a remote code execution (RCE) vulnerability.