https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T04:42:35.473368+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-265198 EUVD-2026-265198 2026-10-07T04:42:35.520882+00:00 EUVD-2026-265198 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21857 fkie_cve-2026-21857 2026-10-07T04:42:35.520923+00:00

REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.

 https://cve.radiocsirt.org/vuln/ghsa-824x-88xg-cwrv GHSA-824x-88xg-cwrv — Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read 2026-10-07T04:42:35.520961+00:00

Affected: Packagist: redaxo/source

### Summary Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. <img width="664" height="899" alt="image" src="https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5" /> <img width="2358" height="445" alt="image" src="https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb" />

### Details The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive.

Vulnerable code: - `redaxo/src/addons/backup/pages/export.php` (lines 72-76) – directly uses `$_POST['EXPDIR']` - `redaxo/src/addons/backup/lib/backup.php` (lines ~413 & ~427) – concatenates unsanitized user input with base path

This allows disclosure of sensitive files such as: - `redaxo/data/core/config.yml` → database credentials + password hashes of all backend users - `.env`, custom configuration files, logs, uploaded malicious files, etc.

### Affected versions ≤ 5.20.1 (confirmed working)

### Patched versions None (as of 2025-12-09)

### PoC – Extracting database credentials and password hashes 1. Log in as any user with Backup permission 2. Go to Backup → Export → Files

<img width="1240" height="960" alt="image" src="https://g…