https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 01:09:15 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-265198 EUVD-2026-265198 https://cve.radiocsirt.org/vuln/euvd-2026-265198 https://cve.radiocsirt.org/vuln/fkie_cve-2026-21857 <p>REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon&#39;s file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.</p> <p>REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon&#39;s file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-21857 https://cve.radiocsirt.org/vuln/ghsa-824x-88xg-cwrv <p><strong>Affected:</strong> Packagist: redaxo/source</p> <p>### Summary Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon&#39;s file export functionality. &lt;img width=&#34;664&#34; height=&#34;899&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5&#34; /&gt; &lt;img width=&#34;2358&#34; height=&#34;445&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb&#34; /&gt;</p> <p>### Details The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive.</p> <p>Vulnerable code: - `redaxo/src/addons/backup/pages/export.php` (lines 72-76) – directly uses `$_POST[&#39;EXPDIR&#39;]` - `redaxo/src/addons/backup/lib/backup.php` (lines ~413 &amp; ~427) – concatenates unsanitized user input with base path</p> <p>This allows disclosure of sensitive files such as: - `redaxo/data/core/config.yml` → database credentials + password hashes of all backend users - `.env`, custom configuration files, logs, uploaded malicious files, etc.</p> <p>### Affected versions ≤ 5.20.1 (confirmed working)</p> <p>### Patched versions None (as of 2025-12-09)</p> <p>### PoC – Extracting database credentials and password hashes 1. Log in as any user with Backup permission 2. Go to Backup → Export → Files</p> <p>&lt;img width=&#34;1240&#34; height=&#34;960&#34; alt=&#34;image&#34; src=&#34;https://g…</p> <p><strong>Affected:</strong> Packagist: redaxo/source</p> <p>### Summary Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon&#39;s file export functionality. &lt;img width=&#34;664&#34; height=&#34;899&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5&#34; /&gt; &lt;img width=&#34;2358&#34; height=&#34;445&#34; alt=&#34;image&#34; src=&#34;https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb&#34; /&gt;</p> <p>### Details The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive.</p> <p>Vulnerable code: - `redaxo/src/addons/backup/pages/export.php` (lines 72-76) – directly uses `$_POST[&#39;EXPDIR&#39;]` - `redaxo/src/addons/backup/lib/backup.php` (lines ~413 &amp; ~427) – concatenates unsanitized user input with base path</p> <p>This allows disclosure of sensitive files such as: - `redaxo/data/core/config.yml` → database credentials + password hashes of all backend users - `.env`, custom configuration files, logs, uploaded malicious files, etc.</p> <p>### Affected versions ≤ 5.20.1 (confirmed working)</p> <p>### Patched versions None (as of 2025-12-09)</p> <p>### PoC – Extracting database credentials and password hashes 1. Log in as any user with Backup permission 2. Go to Backup → Export → Files</p> <p>&lt;img width=&#34;1240&#34; height=&#34;960&#34; alt=&#34;image&#34; src=&#34;https://g…</p> https://cve.radiocsirt.org/vuln/ghsa-824x-88xg-cwrv