CVE-2020-37246

Name of the Vulnerable Software and Affected Versions Supsystic Backup version 2.3.9

Description An issue allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. By using directory traversal sequences in requests to the 'admin.php' endpoint, attackers can access sensitive files such as /etc/passwd or delete files through the removeAction parameter. Directory traversal is a technique that uses special characters to access files and directories outside the intended folder.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.