Description
An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).
References (2)
Core 2
Core References
Vendor Advisory x_refsource_misc
https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1
Exploit, Third Party Advisory x_refsource_misc
https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/
Scores
CVSS v3
5.5
EPSS
0.0428
EPSS Percentile
89.9%
Attack Vector
LOCAL
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Details
CWE
CWE-200
Status
published
Products (1)
unitrends/enterprise_backup
< 9.1
Published
Apr 20, 2017
Tracked Since
Feb 18, 2026