📄 Ilevia EVE X1 Server 4.7.18.0.eden Parameter Traversal / Arbitrary File Access

An unauthenticated absolute and relative path traversal vulnerability exists in the smart home/building automation platform via the /ajax/php/getfilecontent.php endpoint of Ilevia EVE X1 Server versions 4.7.18.0.eden and below. By supplying a crafted file POST parameter, a remote attacker can rea...