CVE-2026-21857: Path Traversal in Redaxo CMS 5.20.1

An attacker exploiting this vulnerability can leverage the Backup addon's file export functionality to read sensitive files located anywhere within the webroot. This includes configuration files, database credentials, and potentially source code. Successful exploitation requires the attacker to be an authenticated user with backup permissions, which may be granted to administrators or other privileged users. The potential impact extends beyond simple information disclosure; an attacker could potentially modify or exfiltrate critical system files, leading to a complete compromise of the Redaxo CMS installation. This vulnerability shares similarities with other path traversal exploits where attackers bypass access controls to read restricted files.

1. Reserved2026-01-05
2. Published2026-01-05
3. Modified2026-02-03
4. EPSS updated2026-03-23

The primary mitigation for CVE-2026-21857 is to immediately upgrade Redaxo CMS to version 5.20.2 or later. If upgrading is not immediately feasible, consider restricting access to the Backup addon's file export functionality to only trusted administrators. Implement strict access controls to limit the number of users with backup permissions. Web application firewalls (WAFs) can be configured to detect and block requests containing suspicious path traversal patterns in the EXPDIR parameter. Monitor web server access logs for unusual file access attempts, particularly those targeting files outside of the expected backup directory.