CVE-2020-36364: Smartstore Smartstorenet

Critical severity, CVSS 9.1. EPSS: 1.8% chance of exploitation in the next 30 days.

An issue was discovered in Smartstore (aka SmartStoreNET) before 4.1.0. Administration/Controllers/ImportController.cs allows path traversal (for copy and delete actions) in the ImportController.Create method via a TempFileName field.

Affected products

• Smartstore Smartstorenet: before 4.1.0 (fixed in 4.1.0)

Published 2021-05-19. Last modified 2026-06-17.