A path traversal flaw in the Backup add‑on’s file export feature allows an authenticated user with backup permissions to read any file inside the webroot. The flaw exists because the add‑on does not validate the EXPDIR POST parameter against a whitelist, so relative or absolute paths containing "../" sequences can be supplied to include arbitrary files in the generated .tar.gz archive. The vulnerability results in disclosure of sensitive data such as configuration files, passwords, or other locally readable information.

The issue affects Redaxo CMS deployments running any version prior to 5.20.2. All installations of Redaxo are susceptible unless the Backup add‑on was not installed or the user lacked backup permissions.

The CVSS base score of 8.3 indicates high severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of analysis. The vulnerability was not listed in the CISA KEV catalog. Exploitation requires legitimate authentication and backup permissions, making the attack vector likely an insider or compromised account rather than an unauthenticated remote attacker.