Vulnerability · Published Feb 3, 2026 · Assigned by VulnCheck

CVE-2020-37086Easy Transfer 1.7 for iOS - Directory Traversal

Medium 6.2

In plain English

A medium-severity path traversal in Easy Transfer from Rubikon Teknoloji. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).

Severity (CVSS 3.1)6.2Medium

Exploit odds (30 days)0.6%top 52.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Easy Transfer 1.7 iOS mobile application contains a directory traversal vulnerability that allows remote attackers to access unauthorized file system paths without authentication. Attackers can exploit the vulnerability by manipulating path parameters in GET and POST requests to list or download sensitive system files and inject malicious scripts into application parameters.

Affected products (as reported)

Vendor	Product	Versions
Rubikon Teknoloji	Easy Transfer	1.7

Weakness: CWE-22 · Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

ExploitDB-48395 exploit
Vulnerability-Lab Advisory technical-description, exploit
Official App Store Product Page product
VulnCheck Advisory: Easy Transfer 1.7 for iOS - Directory Traversal third-party-advisory