CVE-2026-21857

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-21857", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-05T16:44:16.367Z", "datePublished": "2026-01-07T22:32:15.859Z", "dateUpdated": "2026-01-08T18:17:35.890Z"}, "containers": {"cna": {"title": "Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read", "problemTypes": [{"descriptions": [{"cweId": "CWE-24", "lang": "en", "description": "CWE-24: Path Traversal: '../filedir'", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv"}, {"name": "https://github.com/redaxo/redaxo/releases/tag/5.20.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/redaxo/redaxo/releases/tag/5.20.2"}], "affected": [{"vendor": "redaxo", "product": "redaxo", "versions": [{"version": "< 5.20.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T22:32:35.974Z"}, "descriptions": [{"lang": "en", "value": "REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue."}], "source": {"advisory": "GHSA-824x-88xg-cwrv", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-08T15:09:21.125268Z", "id": "CVE-2026-21857", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T18:17:35.890Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-21857", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-08T15:09:21.125268Z"}}}], "references": [{"url": "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-08T15:09:24.426Z"}}], "cna": {"title": "Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read", "source": {"advisory": "GHSA-824x-88xg-cwrv", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "redaxo", "product": "redaxo", "versions": [{"status": "affected", "version": "< 5.20.2"}]}], "references": [{"url": "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv", "name": "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/redaxo/redaxo/releases/tag/5.20.2", "name": "https://github.com/redaxo/redaxo/releases/tag/5.20.2", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-24", "description": "CWE-24: Path Traversal: '../filedir'"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-07T22:32:35.974Z"}}}, "cveMetadata": {"cveId": "CVE-2026-21857", "state": "PUBLISHED", "dateUpdated": "2026-01-08T18:17:35.890Z", "dateReserved": "2026-01-05T16:44:16.367Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-07T22:32:15.859Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "redaxo", "vendor": "redaxo", "versions": [{"status": "affected", "version": "< 5.20.2"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:redaxo:redaxo:*:*:*:*:*:*:*:*", "matchCriteriaId": "5BB9DA06-A124-4435-A4F0-D14EC2F291B8", "versionEndExcluding": "5.20.2", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue."}, {"lang": "es", "value": "REDAXO es un sistema de gesti\u00f3n de contenido basado en PHP. Antes de la versi\u00f3n 5.20.2, los usuarios autenticados con permisos de copia de seguridad pueden leer archivos arbitrarios dentro del directorio ra\u00edz web (webroot) mediante salto de ruta en la funcionalidad de exportaci\u00f3n de archivos del complemento Backup. El complemento Backup no valida el par\u00e1metro POST 'EXPDIR' contra la lista blanca de directorios permitidos generada por la interfaz de usuario. Un atacante puede proporcionar rutas relativas que contengan secuencias '../' (o incluso rutas absolutas dentro del directorio ra\u00edz del documento) para incluir cualquier archivo legible en el archivo '.tar.gz' generado. La versi\u00f3n 5.20.2 corrige este problema."}], "id": "CVE-2026-21857", "lastModified": "2026-06-17T10:19:02.403", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "HIGH", "subIntegrityImpact": "HIGH", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-21857", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-08T15:09:21.125268Z", "version": "2.0.3"}}]}, "published": "2026-01-07T23:15:50.830", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/redaxo/redaxo/releases/tag/5.20.2"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-24"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T16:47:18.233516+00:00", "value": {"mitigation_remediation": ["Upgrade to Redaxo version 5.20.2 or later to apply the vendor\u2011provided validation fix for the EXPDIR parameter", "Disable or uninstall the Backup add\u2011on when it is not required, and restrict backup permissions to trusted administrators only", "Monitor audit logs for unusual backup export activity and review user permissions to ensure that only authorized users can initiate file exports"], "summary": {"action": "Immediate Patch", "impact": "Arbitrary File Read"}, "threat_synthesis": {"affected_systems": "The issue affects Redaxo CMS deployments running any version prior to 5.20.2. All installations of Redaxo are susceptible unless the Backup add\u2011on was not installed or the user lacked backup permissions.", "description_and_impact": "A path traversal flaw in the Backup add\u2011on\u2019s file export feature allows an authenticated user with backup permissions to read any file inside the webroot. The flaw exists because the add\u2011on does not validate the EXPDIR POST parameter against a whitelist, so relative or absolute paths containing \"../\" sequences can be supplied to include arbitrary files in the generated .tar.gz archive. The vulnerability results in disclosure of sensitive data such as configuration files, passwords, or other locally readable information.", "risk_and_exploitability": "The CVSS base score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability was not listed in the CISA KEV catalog. Exploitation requires legitimate authentication and backup permissions, making the attack vector likely an insider or compromised account rather than an unauthenticated remote attacker."}}}}, "created": "2026-01-08T09:48:02.439993+00:00", "updated": "2026-04-18T17:00:05.562433+00:00", "vendors": ["redaxo", "redaxo$PRODUCT$redaxo"]}