漏洞信息
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read
Vulnerability Description
REDAXO is a PHP-based content management system. Prior to version 5.20.2, authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. The Backup addon does not validate the `EXPDIR` POST parameter against the UI-generated allowlist of permitted directories. An attacker can supply relative paths containing `../` sequences (or even absolute paths inside the document root) to include any readable file in the generated `.tar.gz` archive. Version 5.20.2 fixes this issue.
CVSS Information
N/A
Vulnerability Type
路径遍历：’../filedir’
Vulnerability Title
REDAXO 安全漏洞
Vulnerability Description
REDAXO是REDAXO开源的一个内容管理系统。 REDAXO 5.20.2之前版本存在安全漏洞，该漏洞源于Backup附加组件的文件导出功能存在路径遍历，可能导致具有备份权限的用户读取webroot内的任意文件。
CVSS Information
N/A
Vulnerability Type
N/A