Permission Flaw in Suprema BioStar 2 Exposes Backup Files

CVE-2026-9508

What is CVE-2026-9508?

A vulnerability in Suprema BioStar 2, specifically in versions 2.9.3 through 2.9.11, has been discovered that involves incorrect permission settings on critical resources. When administrators configure backup file paths within the NGINX webroot, these files can be publicly accessible. As a result, attackers with mere network access can exploit this flaw to download sensitive backup ZIP files directly without authentication. This exposure can lead to significant security risks, including server impersonation and unauthorized access to critical databases, potentially enabling lateral movement within affected systems.

References