CVE-2026-82264 | BDVDB-2026-366193 Detail
gilbertchenduplicacy
Description#
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.
Impact#
Per CVSS v3.1: confidentiality impact none, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References#
- https://github.com/gilbertchen/duplicacy/issues/692
- https://github.com/gilbertchen/duplicacy
- https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_utils_others.go
- https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_backupmanager.go
- https://www.vulncheck.com/advisories/duplicacy-path-traversal-during-restore-via-unsanitized-snapshot-paths
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.