CVE-2018-20470: Sahi Pro web reports module directory traversal allows arbitrary file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityUnauthenticated network-reachable arbitrary file read with public exploit code and high EPSS, though no KEV listing or confirmed active exploitation.

What it is

Tyto Sahi Pro through 7.x.x and 8.0.0 contains a directory traversal (path traversal) flaw in its web reports module, allowing an outside attacker to read the contents of sensitive files. Because the reports module is web-exposed and the flaw requires no authentication or user interaction, any reachable instance is at risk of file disclosure.

Impact

An attacker gains read access to files on the host that the Sahi Pro service can reach, exposing configuration, credentials or other sensitive data. There is no integrity or availability impact per the CVSS vector.

Attack surface

Reached over the network via the web reports module (AV:N, PR:N, UI:N), so no authentication or user interaction is needed. The description does not specify the exact request path or parameter, so the precise entry point is not documented in this record.

Exploitation

Public exploit references exist (Packet Storm and BarrierSec entries tagged Exploit), and EPSS is 0.4606 (98.8th percentile), indicating elevated likelihood; the CVE is not listed in CISA KEV, so no confirmed in-the-wild exploitation is recorded here.

What to do

• Upgrade Sahi Pro past 8.0.0 to a fixed release; the record does not name a patched version, so confirm with the vendor.
• If patching is not possible, restrict network access to the web reports module to trusted hosts only.
• Run the Sahi Pro service with least privilege so readable files are limited.
• Place the reports module behind an authenticating reverse proxy or WAF that normalizes and blocks traversal sequences.

Detection

• Inspect web server and Sahi Pro logs for requests containing ../ or encoded traversal sequences against the reports module.
• Alert on report requests referencing absolute paths or files outside the expected reports directory.
• Monitor for unusual reads of sensitive files (config, credential stores) by the Sahi Pro process.
• Baseline normal report URLs and flag deviations in path parameters.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.