Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
Summary
Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. <img width="664" height="899" alt="image" src="https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5" /> <img width="2358" height="445" alt="image" src="https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb" />
Details
The Backup addon does not validate the EXPDIR POST parameter against the UI-generated allowlist of permitted directories.
An attacker can supply relative paths containing ../ sequences (or even absolute paths inside the document root) to include any readable file in the generated .tar.gz archive.
Vulnerable code:
redaxo/src/addons/backup/pages/export.php(lines 72-76) – directly uses$_POST['EXPDIR']redaxo/src/addons/backup/lib/backup.php(lines ~413 & ~427) – concatenates unsanitized user input with base path
This allows disclosure of sensitive files such as:
redaxo/data/core/config.yml→ database credentials + password hashes of all backend users.env, custom configuration files, logs, uploaded malicious files, etc.
Affected versions
≤ 5.20.1 (confirmed working)
Patched versions
None (as of 2025-12-09)
PoC – Extracting database credentials and password hashes
- Log in as any user with Backup permission
- Go to Backup → Export → Files
- Intercept the request with Burp Suite
- Change one
EXPDIR[]value to../../../../var/www/html/redaxo/data/core
-
Send request → download archive <img width="423" height="131" alt="image" src="https://github.com/user-attachments/assets/db8a8bda-cdaf-4dea-812f-1e312da908e2" />
-
Extract and open
data/core/config.yml<img width="859" height="281" alt="image" src="https://github.com/user-attachments/assets/c8112ce1-5a1d-435f-953b-7eb4e711e042" />
Result: plaintext database password <img width="2534" height="1198" alt="image" src="https://github.com/user-attachments/assets/218ae917-868a-437e-98b0-6471b82c0b10" />
Impact
Full compromise of the REDAXO installation:
- Database takeover
- Password hash extraction → offline cracking → admin access
- When combined with other vulnerabilities → RCE
CVSS 4.0 vector & score below.
Credits
Discovered by: Łukasz Rybak
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Composer package | redaxo/source | < 5.20.2 | 5.20.2 |
References
- CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N- Weakness (CWE)
CWE-22, CWE-24- Platform
- Composer
- Package
redaxo/source- Disclosed
- 05.01.2026
- Updated
- 11.10.2026 10:22
Sources and licenses
OSV / GitHub Advisory Database - GHSA-824x-88xg-cwrv - CC BY 4.0
Vulnerability history: redaxo/source
All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 18
- First → latest
- 02.2024 09.2026
- Without a fix
- 3
- Exploited in attacks
- 0
Severity breakdown
- High 4
- Medium 11
- Low 3
Disclosures per year
- 2024: 3
- 2025: 7
- 2026: 8
-
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.