PT-2026-2105 · Redaxo · Backup Addon+1

Lukasz-Rybak · Published 2026-01-05 · Updated 2026-01-20 · CVE-2026-21857

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions REDAXO versions prior to 5.20.2

Description REDAXO is a PHP-based content management system. Authenticated users with backup permissions can read arbitrary files within the webroot due to a path traversal issue in the Backup addon’s file export functionality. The Backup addon does not validate the EXPDIR POST parameter against a permitted directory allowlist. An attacker can use relative paths containing ../ sequences, or even absolute paths within the document root, to include any readable file in a generated .tar.gz archive. The EXPDIR parameter is vulnerable to path traversal.

Recommendations Versions prior to 5.20.2 should be updated to version 5.20.2 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-24

CWE-22

Related Identifiers

CVE-2026-21857

GHSA-824X-88XG-CWRV

Affected Products

Backup Addon

Redaxo

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21857.json · Exploit
• 🔥 https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrv · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-21857 · Security Note
• https://osv.dev/vulnerability/CVE-2026-21857 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-824x-88xg-cwrv · Vendor Advisory
• https://github.com/redaxo/redaxo · Note
• https://github.com/redaxo/redaxo/releases/tag/5.20.2 · Note
• https://twitter.com/CVEnew/status/2009032503915630713 · Twitter Post
• https://t.me/cveNotify/148011 · Telegram Post
• https://t.me/CVEtracker/41658 · Telegram Post
• https://t.me/cveNotify/149323 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2009160193515344333 · Twitter Post