CVE-2026-21857
Last modified
CVE-2026-21857 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. EPSS estimates a 0.49% chance of exploitation in the next 30 days.
Description
REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Redaxo | Redaxo | < 5.20.2 |
References
- https://github.com/redaxo/redaxo/releases/tag/5.20.2Release Notes
- https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrvExploit, Vendor Advisory
- https://github.com/redaxo/redaxo/security/advisories/GHSA-824x-88xg-cwrvExploit, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-21857?
How severe is CVE-2026-21857?
How do I fix CVE-2026-21857?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-21851MONAI (Medical Open Network for AI) is an AI toolkit for hea…5.3
- CVE-2026-21852Claude Code is an agentic coding tool. Prior to version 2.0.…7.5
- CVE-2026-21853AFFiNE is an open-source, all-in-one workspace and an operat…8.8
- CVE-2026-21854The Tarkov Data Manager is a tool to manage the Tarkov item …9.8
- CVE-2026-21855The Tarkov Data Manager is a tool to manage the Tarkov item …6.1
- CVE-2026-21856The Tarkov Data Manager is a tool to manage the Tarkov item …8.8
- CVE-2026-21858n8n is an open source workflow automation platform. Versions…10
- CVE-2026-21859Mailpit is an email testing tool and API for developers. Ver…5.3
- CVE-2026-2186A vulnerability has been found in Tenda RX3 16.03.13.11. Imp…8.8
- CVE-2026-21860Werkzeug is a comprehensive WSGI web application library. Pr…5.3
- CVE-2026-21861baserCMS is a website development framework. Prior to versio…7.2
- CVE-2026-21862RustFS is a distributed object storage system built in Rust.…7.5
Are you affected by CVE-2026-21857?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST