CVE-2020-36364

CRITICAL 9.1CVE-2020-36364 · Published 19/05/2021 · updated 17/06/2026

In short

CVE-2020-36364 is a CRITICAL (CVSS 9.1) vulnerability affecting smartstorenet (smartstore).
Chance of exploitation in the next 30 days (EPSS): 1.8%, higher than 78.5% of all vulnerabilities.
Fix: update to 4.1.0 or later.

Package	Affected versions	Patched versions
smartstorenet smartstore	`< 4.1.0`	`4.1.0`

Description

An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and delete actions) in the ImportController.Create method via a TempFileName field.

References

smartstore/SmartStoreNET commit 5ab1e37 · Patch
smartstore/SmartStoreNET · Exploit

More vulnerabilities in smartstorenet

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free