Listen to this Post
The vulnerability exploits the Backup addon’s file export functionality in REDAXO. Authenticated users with backup permissions can manipulate the EXPDIR POST parameter. The addon fails to validate this parameter against the UI-generated allowlist of permitted directories. By supplying relative paths with ../ sequences or absolute paths within the document root, attackers can include arbitrary readable files from the webroot into the generated .tar.gz archive. The vulnerable code in export.php directly uses $_POST[‘EXPDIR’] without sanitization. In backup.php, unsanitized user input is concatenated with the base path. This path traversal allows reading sensitive files like config.yml, which contains plaintext database credentials and password hashes for all backend users. Other files such as .env, custom configurations, logs, and uploaded files can also be disclosed, leading to full system compromise.
Platform: REDAXO
Version: ≤5.20.1
Vulnerability: Path Traversal
Severity: Critical
date: 2025-12-09
Prediction: Patch TBD
What Undercode Say:
Analytics
Example bash command to simulate directory traversal
curl -X POST -d "EXPDIR[]=../../../../var/www/html/redaxo/data/core" http://target/redaxo/index.php?page=backup/export
Code snippet from vulnerable export.php (lines 72-76)
$dirs = rex_post('EXPDIR', 'array');
foreach ($dirs as $dir) {
$path = $backupDir . '/' . $dir;
// No validation on $dir
}
Code snippet from vulnerable backup.php (lines ~413 & ~427)
$fullPath = $basePath . $userInput; // $userInput is unsanitized
How Exploit:
Authenticated user intercepts export request, modifies EXPDIR parameter with path traversal sequences to include sensitive files like config.yml in the backup archive, then extracts credentials.
Protection from this CVE
Sanitize user input, validate paths against allowlist, implement proper access controls, update to patched version when available.
Impact:
Database takeover, password hash theft, admin access, potential RCE.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
