Active Backup for Business CVE-2025-30028

Active Backup for Business is Synology's enterprise backup application, distributed as an installable package that runs on DSM-based NAS appliances and backs up servers, VMs, and PCs. The root cause is classified as CWE-89 (SQL Injection) and the vendor tags it 'SQLi', meaning attacker-controlled input is concatenated into a backend database query without proper parameterization. In this case the injection is leveraged not to alter data but to read arbitrary files - consistent with the CVSS impact profile of C:H/I:N/A:N (confidentiality only), which suggests the injected query is used to coerce the database or application into returning file contents rather than to modify state. The CVSS scope-changed flag (S:C) indicates the impact reaches resources beyond the vulnerable application's own security context, such as files belonging to the underlying DSM system. No CPE strings were provided in the source data, so affected-product identification relies on the EUVD version ranges and the Synology advisory.