# CVE-2020-37278: Weaver e-Bridge arbitrary file read in saveYZJFile

Source: https://junglewise.ai/threats/cve-2020-37278-weaver-e-bridge-contains-an-unauthenticated-arbitrary-file-read  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-02. Updated: 2026-10-05  
License: CC BY 4.0 with a link back

CVE-2020-37278 · Severity: high · CVSS 7.5 · Published 2026-10-02

Weaver e-Bridge is a collaboration and communications platform used in enterprise environments. An unauthenticated attacker can read arbitrary files from the server, including sensitive system files and credentials, by crafting a malicious request to the saveYZJFile endpoint. The same vulnerability also enables server-side request forgery attacks against internal network resources, potentially exposing data or facilitating lateral movement within the organization.

Vendors: [Weaver](https://junglewise.ai/threats/vendors/weaver).

## Quick answers

**Is CVE-2020-37278 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37278 being exploited in the wild.

**How severe is CVE-2020-37278?** High severity, with a CVSS score of 7.5, published 2 October 2026.

**Which products and versions are affected?** Weaver e-Bridge.

**Is there a fix for CVE-2020-37278?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-37278 attacked?** It is attacked over the network.

**Am I affected by CVE-2020-37278?** Check whether you run Weaver e-Bridge. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a path traversal / local file inclusion (CWE-22) in the saveYZJFile endpoint that allows unauthenticated remote attackers to supply a file: URL via the downloadUrl parameter to read arbitrary files. The endpoint also supports http(s) URLs, enabling server-side request forgery (CWE-918) against internal resources. No authentication or user interaction is required for exploitation; attackers need only network access to the e-Bridge instance.

## Affected products

- Weaver e-Bridge

## Timeline

- 2023-10-17: disclosed: Exploitation evidence first observed by Shadowserver Foundation
- 2026-10-02: advisory

## References

- [https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/weaver-ebridge-lfi.yaml](https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/weaver/weaver-ebridge-lfi.yaml)
- [https://www.vulncheck.com/advisories/weaver-e-bridge-unauthenticated-arbitrary-file-read-via-saveyzjfile](https://www.vulncheck.com/advisories/weaver-e-bridge-unauthenticated-arbitrary-file-read-via-saveyzjfile)