Suprema BioStar 2 versions 2.9.3 through 2.9.11 expose backup ZIP files in the NGINX webroot when an administrator sets the backup path inside that directory. Because the web server does not enforce authentication for files in that location, an attacker on the network can directly request the backup files via the URL pattern http(s)://[server]/download/... and receive the user‑level backup archive without login. The backup archive contains database dumps, configuration and other sensitive data, allowing an adversary to obtain credentials, impersonate the server, or move laterally within the network. This weakness is a classic example of incorrect permission assignment (CWE‑732) and results in a loss of confidentiality.

All instances of Suprema BioStar 2 servers running versions 2.9.3 to 2.9.11 that have configured their backup storage location inside the NGINX webroot are affected. The vulnerability only exists when the backup files are stored in the specified public web directory; other backup locations or versions are not impacted.

The CVSS score of 10 signals a critical flaw, and the vulnerability can be exploited simply by sending an unauthenticated HTTP GET request to the exposed /download/ endpoint. The EPSS score is not available, but the lack of authentication and the public nature of the resource make exploitation highly likely for an entity with network reach. Since the vulnerability is not listed in CISA’s KEV catalog, it may not yet have active exploitation in the wild, yet the ease of exploitation and the sensitivity of the exposed data make it a high‑priority risk for affected deployments.