Home

Description

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.

PUBLISHED Reserved 2026-05-16 | Published 2026-05-16 | Updated 2026-05-18 | Assigner VulnCheck




MEDIUM: 6.9CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
MEDIUM: 6.2CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Problem types

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Product status

2.3.9
affected

Credits

Erik David Martin finder

References

www.exploit-db.com/exploits/49545 (ExploitDB-49545) exploit

supsystic.com/ (Official Product Homepage) product

downloads.wordpress.org/plugin/backup-by-supsystic.zip (Product Reference) product

www.vulncheck.com/...n-supsystic-backup-local-file-inclusion (VulnCheck Advisory: WordPress Plugin Supsystic Backup 2.3.9 Local File Inclusion) third-party-advisory

cve.org (CVE-2020-37246)

nvd.nist.gov (CVE-2020-37246)

Download JSON