| Package | Affected versions | Patched versions |
|---|---|---|
| enterprise backup | ≤ 9.1.1 |
An authenticated user of Unitrends Enterprise Backup before 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free