PT-2026-23676 · Undefined · Undefined

Published 2026-03-06 · Updated 2026-03-06 · CVE-2018-25164

NVD

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application data and credentials.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2018-25164

Affected Products

Undefined

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-25164 · Security Note
• https://vulncheck.com/advisories/eversync-arbitrary-file-download-via-files-directory · Note
• https://exploit-db.com/exploits/45868 · Note