CVE-2017-7282

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).

• CWE-200

• https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/Exploit, Third Party Advisory
• https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1Vendor Advisory
• https://rhinosecuritylabs.com/research/remote-code-execution-bug-hunting-chapter-2/Exploit, Third Party Advisory
• https://support.unitrends.com/UnitrendsBackup/s/article/ka640000000CcWGAA0/000005558?r=1Vendor Advisory

Published

Apr 20, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-7276There is reflected XSS in TOPdesk before 5.7.6 and 6.x and 7…
• CVE-2017-7277The TCP stack in the Linux kernel through 4.10.6 mishandles …
• CVE-2017-7278Unspecified vulnerability in ASSA ABLOY APTUS Styra Porttele…
• CVE-2017-7279An unprivileged user of the Unitrends Enterprise Backup befo…
• CVE-2017-7280An issue was discovered in api/includes/systems.php in Unitr…
• CVE-2017-7281An issue was discovered in Unitrends Enterprise Backup befor…
• CVE-2017-7283An authenticated user of Unitrends Enterprise Backup before …
• CVE-2017-7284An attacker that has hijacked a Unitrends Enterprise Backup …
• CVE-2017-7285A vulnerability in the network stack of MikroTik Version 6.3…
• CVE-2017-7286Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-7288Cross-site scripting (XSS) vulnerability in Zimbra Collabora…
• CVE-2017-7290SQL injection vulnerability in XOOPS 2.5.7.2 and other versi…