CVE-2017-7282
This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).
Does this matter?
Lower severity and a low EPSS score (4.28%). Track it; it rarely justifies an emergency change on its own.
Description
An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).
- CVSS 3.0
- 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- EPSS
- 4.28% probability · 91th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- unitrends/enterprise backup
- Source
- cve@mitre.org
EPSS moved from 3.2% on 21 September 2026 to 4.3% on 27 October 2026.
References
- https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/Exploit, Third Party Advisory
- https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1Vendor Advisory
- https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/Exploit, Third Party Advisory
- https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.