CVE-2020-35362: Improper Limitation of a Pathname to a Restricted Directory

DEXT5Upload 2.7.1262310 and earlier is affected by Directory Traversal in handler/dext5handler.jsp. This could allow remote files to be downloaded via a dext5CMD=downloadRequest action with traversal in the fileVirtualPath parameter the attacker must provide the correct fileOrgName value...

PT-2020-17315

Name of the Vulnerable Software and Affected Versions DEXT5Upload versions 2.7.1262310 and earlier Description The issue allows remote files to be downloaded via a "dext5CMD=downloadRequest" action with traversal in the fileVirtualPath parameter, provided the attacker has the correct fileOrgName...