CVE-2024-35431

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...

CVE-2024-35431

ZKTeco ZKBio CVSecurity (specifically version 6.1.1 , with reports including up to 6.4.1 ) is vulnerable to a Directory Traversal flaw via the photoBase64 parameter. This vulnerability allows an unauthenticated user to perform a path traversal attack (e.g., dir .. ..filename) to download local fi...

ZKTeco ZKBioSecurity 安全漏洞

ZKTeco ZKBioSecurity is a web-based all-in-one platform from the Chinese company ZKTeco. A security vulnerability exists in ZKTeco ZKBioSecurity version 6.1.1, which originates from a directory traversal vulnerability in photoBase64 that allows unauthenticated users to download local files from t...

CVE-2024-35431: Path Traversal: 'dir\..\..\filename'

ZKTeco ZKBio CVSecurity 6.1.1 is vulnerable to Directory Traversal via photoBase64. An unauthenticated user can download local files from the server. NOTE: Third parties have indicated other versions are also vulnerable including up to 6.4.1...