CVE-2026-21857
High · 8.7Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
CVSS
8.7
EPSS
0.5%
Published
Jan 5, 2026
CISA due date
—
The record
Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. <img width="664" height="899" alt="image" src="https://github.com/user-attachments/assets/fd1ca69e-b275-4daf-9a62-621cde6525f5" /> <img width="2358" height="445" alt="image" src="https://github.com/user-attachments/assets/fad81152-9e1b-413e-9823-09540a23e2fb" />
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | redaxo/source | 0 | 5.20.2 |
Related vulnerabilities
- GHSA-824x-88xg-cwrv Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read Same vulnerability
- GHSA-x6vr-q3vf-vqgq REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] Also affects redaxo/source
- GHSA-vqc7-7fj4-3fm3 REDAXO CMS is vulnerable to XSS through its module management component Also affects redaxo/source
- GHSA-xj9j-gjxg-7jvq REDAXO CMS is vulnerable to RCE attack through its template management component Also affects redaxo/source
- CVE-2025-64050 REDAXO CMS is vulnerable to RCE attack through its template management component Also affects redaxo/source
- CVE-2025-64049 REDAXO CMS is vulnerable to XSS through its module management component Also affects redaxo/source
- CVE-2025-66026 REDAXO CMS is vulnerable to Reflected XSS in Mediapool Info Banner via args[types] Also affects redaxo/source
- CVE-2026-81163 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')… CWE-22