CVE-2020-37246

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.

CVSS v3 6.2 MEDIUM

6.2^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://downloads.wordpress.org/plugin/backup-by-supsystic.zip
https://supsystic.com/
https://www.exploit-db.com/exploits/49545
https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion

Configurations

No configuration.

History

29 Sep 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Supsystic Backup 2.3.9 contiene una vulnerabilidad de inclusión local de ficheros que permite a atacantes no autenticados leer y eliminar ficheros arbitrarios manipulando el parámetro de ruta de descarga. Los atacantes pueden modificar el parámetro download en las solicitudes de admin.php con secuencias de salto de directorio para acceder a ficheros sensibles como /etc/p4ssd o eliminar ficheros a través del parámetro removeAction.

Information

Published : 2026-05-16 16:16

Updated : 2026-09-29 10:10

NVD link : CVE-2020-37246

Mitre link : CVE-2020-37246

CVE.ORG link : CVE-2020-37246

JSON object : View

Products Affected

No product.

CWE

CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

{"id": "CVE-2020-37246", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2020-37246", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-18T17:35:07.238097Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.2, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.5}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Supsystic", "product": "Backup", "versions": [{"status": "affected", "version": "2.3.9"}]}]}], "published": "2026-05-16T16:16:20.993", "references": [{"url": "https://downloads.wordpress.org/plugin/backup-by-supsystic.zip", "source": "disclosure@vulncheck.com"}, {"url": "https://supsystic.com/", "source": "disclosure@vulncheck.com"}, {"url": "https://www.exploit-db.com/exploits/49545", "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion", "source": "disclosure@vulncheck.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-98"}]}], "descriptions": [{"lang": "en", "value": "Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter."}, {"lang": "es", "value": "Supsystic Backup 2.3.9 contiene una vulnerabilidad de inclusi\u00f3n local de ficheros que permite a atacantes no autenticados leer y eliminar ficheros arbitrarios manipulando el par\u00e1metro de ruta de descarga. Los atacantes pueden modificar el par\u00e1metro download en las solicitudes de admin.php con secuencias de salto de directorio para acceder a ficheros sensibles como /etc/p4ssd o eliminar ficheros a trav\u00e9s del par\u00e1metro removeAction."}], "lastModified": "2026-09-29T10:10:00.263", "sourceIdentifier": "disclosure@vulncheck.com"}