PT-2026-41446 · Supsystic · Ibackup

Published 2026-05-16 · Updated 2026-05-16 · CVE-2020-37246

NVD

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Supsystic Backup 2.3.9 contains a local file inclusion vulnerability that allows unauthenticated attackers to read and delete arbitrary files by manipulating the download path parameter. Attackers can modify the download parameter in admin.php requests with directory traversal sequences to access sensitive files like /etc/passwd or delete files via the removeAction parameter.

Exploit

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2020-37246

Affected Products

Ibackup

References · 5

• 🔥 https://exploit-db.com/exploits/49545 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-37246 · Security Note
• https://vulncheck.com/advisories/wordpress-plugin-supsystic-backup-local-file-inclusion · Note
• https://downloads.wordpress.org/plugin/backup-by-supsystic.zip · Note
• https://supsystic.com · Note