Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
Summary
Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. <img width="664" height="899" alt="image" src="https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5" /> <img width="2358" height="445" alt="image" src="https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb" />
Details
The Backup addon does not validate the EXPDIR POST parameter against the UI-generated allowlist of permitted directories.
An attacker can supply relative paths containing ../ sequences (or even absolute paths inside the document root) to include any readable file in the generated .tar.gz archive.
Vulnerable code:
redaxo/src/addons/backup/pages/export.php(lines 72-76) – directly uses$_POST['EXPDIR']redaxo/src/addons/backup/lib/backup.php(lines ~413 & ~427) – concatenates unsanitized user input with base path
This allows disclosure of sensitive files such as:
redaxo/data/core/config.yml→ database credentials + password hashes of all backend users.env, custom configuration files, logs, uploaded malicious files, etc.
Affected versions
≤ 5.20.1 (confirmed working)
Patched versions
None (as of 2025-12-09)
PoC – Extracting database credentials and password hashes
- Log in as any user with Backup permission
- Go to Backup → Export → Files
- Intercept the request with Burp Suite
- Change one
EXPDIR[]value to../../../../var/www/html/redaxo/data/core
-
Send request → download archive <img width="423" height="131" alt="image" src="https://github.com/user-attachments/assets/db8a8bda-cdaf-4dea-812f-1e312da908e2" />
-
Extract and open
data/core/config.yml<img width="859" height="281" alt="image" src="https://github.com/user-attachments/assets/c8112ce1-5a1d-435f-953b-7eb4e711e042" />
Result: plaintext database password <img width="2534" height="1198" alt="image" src="https://github.com/user-attachments/assets/218ae917-868a-437e-98b0-6471b82c0b10" />
Impact
Full compromise of the REDAXO installation:
- Database takeover
- Password hash extraction → offline cracking → admin access
- When combined with other vulnerabilities → RCE
CVSS 4.0 vector & score below.
Credits
Discovered by: Łukasz Rybak
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Paquete de Composer | redaxo/source | < 5.20.2 | 5.20.2 |
Referencias
- Vector CVSS
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N- Debilidad (CWE)
CWE-22, CWE-24- Plataforma
- Composer
- Paquete
redaxo/source- Publicada
- 05.01.2026
- Actualizado
- 11.10.2026 10:22
Fuentes y licencias
OSV / GitHub Advisory Database - GHSA-824x-88xg-cwrv - CC BY 4.0
Historial de vulnerabilidades: redaxo/source
Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 18
- Primera → última
- 02.2024 09.2026
- Sin corrección
- 3
- Explotada en ataques
- 0
Distribución por gravedad
- Alta 4
- Media 11
- Baja 3
Divulgaciones por año
- 2024: 3
- 2025: 7
- 2026: 8
-
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.