CVE-2017-7283

HIGH 8.8CVE-2017-7283 · Published 20/04/2017 · updated 17/06/2026

In short

CVE-2017-7283 is a HIGH (CVSS 8.8) vulnerability affecting enterprise backup (unitrends).
Chance of exploitation in the next 30 days (EPSS): 4.3%, higher than 91.1% of all vulnerabilities.
No patched version is listed yet: follow the vendor's advisory in References.

Package	Affected versions	Patched versions
enterprise backup unitrends	`≤ 9.1.1`	No fix yet

Description

An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.

References

rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2 · Exploit
support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWBAA0/000005557 · Vendor Advisory

More vulnerabilities in enterprise backup

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

enterprise backup

unitrends

≤ 9.1.1

No fix yet

More vulnerabilities in enterprise backup

See all →