CVE-2026-39169 Details

A vulnerability in SEMCMS versions through 5.0 allows unauthorized access to the database backup export feature in SEMCMS_copy.php. The file lacks proper authentication and authorization, enabling unauthenticated users to request a complete SQL database backup. This backup is then stored in a predictable location and can be downloaded, potentially exposing sensitive information such as administrator credentials, user data, website configuration, and other confidential records.

To address this vulnerability, restrict access to SEMCMS_copy.php, implement proper authentication and authorization checks for the backup export function, disable direct access to backup files, store backup files outside the web root, and correct the syntax error in the backup module.