CVE-2026-21857: 
PHP vulnerability analysis and mitigation

CVE-2026-21857 is a path traversal vulnerability in the REDAXO CMS Backup addon that allows authenticated users with backup permissions to read arbitrary files within the webroot. It affects all REDAXO versions up to and including 5.20.1 (composer package redaxo/source). The vulnerability was discovered by Łukasz Rybak, disclosed and patched on January 5, 2026. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 8.3 (High) (Github Advisory, REDAXO Release).

The root cause is improper input validation classified under CWE-22 (Path Traversal) and CWE-24 (Path Traversal: ../filedir). Specifically, redaxo/src/addons/backup/pages/export.php (lines 72–76) directly uses the $_POST['EXPDIR'] parameter without validating it against the UI-generated allowlist of permitted directories, and redaxo/src/addons/backup/lib/backup.php (lines ~413 and ~427) concatenates this unsanitized input with a base path. An attacker can supply relative paths with ../ sequences or absolute paths within the document root to include arbitrary readable files in the generated .tar.gz backup archive (Github Advisory, REDAXO Security Advisory).

Successful exploitation allows an authenticated attacker with backup permissions to extract sensitive files — including redaxo/data/core/config.yml (containing database credentials and password hashes of all backend users), .env files, custom configuration files, logs, and uploaded files — into a downloadable .tar.gz archive. This can lead to full compromise of the REDAXO installation through database takeover, offline cracking of extracted password hashes to gain admin access, and potentially remote code execution when chained with other vulnerabilities (Github Advisory).

A proof-of-concept exploit is publicly documented in the security advisory, detailing exact steps using Burp Suite to intercept and modify the EXPDIR[] POST parameter. The exploit is also indexed on Sploitus. There is no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.035% (0.000440 per Feedly), placing it in the 11th percentile for exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires high privileges (backup addon permissions), limiting the attacker pool (Github Advisory).

1. Obtain backup permissions: Acquire or compromise a REDAXO backend account that has been granted Backup addon permissions.
2. Navigate to the export function: Log in to the REDAXO backend and navigate to Backup → Export → Files to trigger the normal file export workflow.
3. Intercept the request: Use a proxy tool such as Burp Suite to intercept the outgoing POST request generated when initiating a file export.
4. Manipulate the EXPDIR parameter: Modify one or more EXPDIR[] POST parameter values to a path-traversal sequence pointing to a target file, e.g., ../../../../var/www/html/redaxo/data/core to target the configuration directory.
5. Submit the modified request: Forward the tampered request to the server. The Backup addon will include the specified directory/files in the generated .tar.gz archive without validation.
6. Download and extract the archive: Download the resulting backup archive and extract it locally.
7. Access sensitive data: Open the extracted files (e.g., data/core/config.yml) to retrieve plaintext database credentials, password hashes, API keys, or other sensitive configuration data for further exploitation (Github Advisory, REDAXO Security Advisory).

• Network: Unusual POST requests to the REDAXO backup export endpoint (e.g., /redaxo/index.php?page=backup/export) containing EXPDIR[] values with ../ sequences or absolute paths outside expected backup directories.
• Logs: Web server access logs showing POST requests to the backup export page from authenticated sessions, particularly with abnormally large or unusual EXPDIR parameter values; repeated backup export requests in a short timeframe.
• File System: Unexpected .tar.gz backup archives in the backup output directory containing files from outside the normal backup scope (e.g., config.yml, .env files); backup archives significantly larger than typical or containing unexpected directory structures.
• Application: REDAXO backend audit logs (if enabled) showing backup export actions by accounts not typically performing backups, or at unusual times (Github Advisory).

Update REDAXO to version 5.20.2 or later, which fixes the issue by implementing proper validation of the EXPDIR POST parameter against the allowlist of permitted directories (Backup addon version 2.9.4) (REDAXO Release). As interim mitigations, restrict Backup addon permissions exclusively to fully trusted administrators, monitor backup creation activities for anomalous behavior, and review web server file system permissions to minimize the exposure of sensitive files readable by the web server process (Github Advisory).

The vulnerability was reported by security researcher Łukasz Rybak and promptly patched by REDAXO maintainer gharlan on the same day as disclosure (January 5, 2026). The advisory was published via GitHub Security Advisories and received standard aggregation coverage from vulnerability tracking services including VulnDB, INCIBE-CERT, and Sploitus. No significant broader media coverage or notable community debate has been identified (Github Advisory, REDAXO Release).