Path Traversal in Twinkle Toes Software Booked Scheduler
CVE-2020-37077
Booked Scheduler 2.7.7 contains a directory traversal vulnerability in the manage_email_templates.php script that allows authenticated administrators to access unauthorized files. Attackers can exploit the vulnerable 'tn' parameter to read files outside the intended directory by manipulating directory path traversal techniques.
Vulnerability class: Path Traversal (Directory Traversal)
EPSS: 0.006 (45.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Twinkle Toes Software Booked Scheduler — versions 2.7.7
Weakness classification (CWE)
References
- disclosure@vulncheck.com (exploit)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (product)
- disclosure@vulncheck.com (third-party-advisory)
Frequently asked questions
- What is CVE-2020-37077?
- CVE-2020-37077 is a medium-severity vulnerability in Twinkle Toes Software Booked Scheduler, classified under Path Traversal. CVSS score: 6.5/10. Published 2026-02-03.
- How severe is CVE-2020-37077?
- Medium severity. CVSS v3 base score is 6.5 out of 10.