CVE-2019-10266

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 13.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2019-07-26 · updated 2026-06-17
Weakness: CWE-611

Description

An issue was discovered in Ahsay Cloud Backup Suite before 8.1.1.50. When sending an out-of-bounds XML document to a URL, it is possible to read the file structure and even the content of files without authentication.

Affected products

Ahsay Cloud Backup Suite: from 7.7.0.0 before 8.1.1.50 — fixed in 8.1.1.50

How to fix

Upgrade to a fixed version: Ahsay Cloud Backup Suite 8.1.1.50. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/153772/Ahsay-Backup-7.x-8.x-XML-Injection.html
https://www.wbsec.nl/ahsay/
http://packetstormsecurity.com/files/153772/Ahsay-Backup-7.x-8.x-XML-Injection.html
https://www.wbsec.nl/ahsay/

Get alerted when CVE-2019-10266 or the next vulnerability affects your stack