| Package | Affected versions | Patched versions |
|---|---|---|
| enterprise backup | ≤ 9.1 |
An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free