Veeam Backup & Replication CVE-2026-108140

Exploitation requires two concurrent prerequisites explicitly stated in the description: (1) an authenticated account holding the Veeam Restore Operator role (reflected as PR:H), and (2) attacker control over the contents of a NAS share that is backed up by that Veeam server. The attacker crafts files with relative path-traversal names so that processing/restoration writes them to an arbitrary path on the backup server. Limiting factors: this is not remote-unauthenticated - it needs a specific delegated role plus a position of control over backup source data, and the CVSS AC:H/AT:P metrics indicate the traversal/restore condition is not guaranteed on every attempt; affected deployments are limited to Backup and Replication 13.0 before 13.0.3 and 13.1 before 13.1.2.

This is a medium-severity (CVSS 4.0 base 5.9), high-barrier integrity flaw, not an emergency. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:H/UI:N) signals the key constraints: it requires high privileges (PR:H - an authenticated account holding the Restore Operator role) AND a present-but-not-attacker-guaranteed condition (AT:P) AND high attack complexity (AC:H), because the attacker must additionally control the contents of a backed-up NAS share that is then restored. Impact is scoped to integrity (VI:H with VA:L, i.e. VC:N/SC:N/SI:N/SA:N) - arbitrary file write on the backup server, with no direct confidentiality loss reflected in the metrics. No EPSS score was provided and the vulnerability is NOT in CISA KEV; no POC or exploit reference is present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The vendor decision label is 'this_month' (not act_now/emergency), consistent with a privileged-insider / supply-chain-of-backup-data vector rather than broad opportunistic exploitation. Net: genuinely privileged and conditional - a real concern where Restore Operator duties are delegated or NAS backup sources are not trusted, but low likelihood of widespread exploitation. Missing signal to note: no EPSS and no independent POC confirmation were supplied, so real-world exploitation probability cannot be quantified from this data.

An authenticated user holding the Veeam Restore Operator role who can also influence the files on a NAS share that Veeam backs up plants files with crafted relative path names (containing traversal sequences) in that share. When those contents are processed/restored by the backup server, the traversal causes attacker-controlled files to be written to an arbitrary location on the backup server, potentially overwriting or implanting executable or configuration content. No public exploit code or POC reference is present in the supplied data.