Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

MyBackup 1.4.0 lets attackers read any file

CVE-2009-4978 · published 16 years ago
Summary

The down.php page in MyBackup version 1.4.0 does not properly check the file name you request. An attacker can add ".." to the name and trick the system into showing files from anywhere on the server. Update MyBackup to a newer version or apply the vendor’s patch, and limit access to the download script.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
tufat mybackup 1.4.0
cpe:2.3:a:tufat:mybackup:1.4.0:*:*:*:*:*:*:*
Original advisory text
Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
Directory traversal vulnerability in down.php in MyBackup 1.4.0 allows remote attackers to read arbitrary files via a .. (dot dot) in the filename parameter.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
3% chance of attack within 30 days
Type
CWE-22Path Traversal
Timeline
Published25 Aug 2010
Updated30 Oct 2026
First seen29 Sep 2026
Sources
CVE-2009-4978 · NVD
Track software like this
Free during beta