CVE-2018-25164CWE-552

EverSync 0.5 Arbitrary File Download via files Directory

High · published March 6, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
19.0
In the wild
Unconfirmed
What it is

EverSync 0.5 contains an arbitrary file download vulnerability that allows unauthenticated attackers to access sensitive files by requesting them directly from the files directory. Attackers can send GET requests to the files directory to download database files like db.sq3 containing application data and credentials.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00276 · 19.0th percentile
Weakness
CWE-552 · Files or Directories Accessible to External Parties
Published
2026-03-06T12:18Z
EPSS history
Timeline
  • 06 MAR 12:18Z
    EverSync 0.5 Arbitrary File Download via files Directory
    cvelistv5