CVE-2016-20104 EyeLock nano NXT 3.05.1193 Path Traversal via logdownload.php

High 8.7 Published 20 Oct 2026 Updated 23 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2016-20104?

CVE-2016-20104 is a high-severity vulnerability in EyeLock nano NXT, published on 20 Oct 2026.

Official description

EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files via the 'path' parameter. Attackers can send GET requests to /scripts/logdownload.php with traversal sequences like ../../etc/passwd, which readfile() returns unvalidated, disclosing local system files. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-19.

Weakness: CWE-22

Which versions are affected by CVE-2016-20104?

How do I fix CVE-2016-20104?

No fix has been published for CVE-2016-20104 yet. Limit exposure of the affected software until one is available.

Is CVE-2016-20104 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2016-20104 exists.

Sources

Also known as GHSA-r7vf-jgv9-h5jm.