CVE-2020-37086
Easy Transfer 1.7 for iOS - Directory Traversal
- State
- Published
- Severity
- 6.9 Medium
- Published
- Feb 3, 2026
- Updated
- Feb 4, 2026
- Reserved
- Feb 1, 2026
Description
Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to access unauthorized file system paths without authentication. Attackers can exploit the vulnerability by manipulating path parameters in GET and POST requests to list or download sensitive system files and inject malicious scripts into application parameters.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.2 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | VulnCheck |
Weaknesses
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected Products
| Product | Versions |
|---|---|
Easy TransferRubikon Teknoloji |
|
References
- ExploitDB-48395exploit
- Vulnerability-Lab Advisorytechnical-descriptionexploit
- Official App Store Product Pageproduct
- VulnCheck Advisory: Easy Transfer 1.7 for iOS - Directory Traversalthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.