EUVD-2026-23354
GHSA-8cfg-qq42-h3w8
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The JetBackup - Backup, Restore & Migrate plugin for WordPress is vulnerable to Path Traversal leading to Arbitrary Directory Deletion in versions up to and including 3.1.19.8. This is due to insufficient input validation on the fileName parameter in the file upload handler. The plugin sanitizes the fileName parameter using sanitize_text_field(), which removes HTML tags but does not prevent path traversal sequences like '../'. The unsanitized filename is then directly concatenated in Upload::getFileLocation() without using basename() or validating the resolved path stays within the intended directory. When an invalid file is uploaded, the cleanup logic calls dirname() on the traversed path and passes it to Util::rm(), which recursively deletes the entire resolved directory. This makes it possible for authenticated attackers with administrator-level access to traverse outside the intended upload directory and trigger deletion of critical WordPress directories such as wp-content/plugins, effectively disabling all installed plugins and causing severe site disruption.
AnalysisAI
JetBackup plugin for WordPress versions up to 3.1.19.8 allows authenticated administrators to delete arbitrary directories via path traversal in the file upload handler. The vulnerability stems from insufficient input validation on the fileName parameter, which is sanitized using sanitize_text_field() but still permits path traversal sequences like '../'. When combined with the recursive directory deletion logic in the cleanup routine, attackers can traverse outside the intended upload directory and delete critical WordPress directories such as wp-content/plugins, completely disabling all plugins and severely disrupting the WordPress installation.
Technical ContextAI
The vulnerability exists in JetBackup's Upload class, specifically in the getFileLocation() method, which concatenates user-supplied filenames directly without path validation. The plugin uses WordPress's sanitize_text_field() function, which is designed to remove HTML tags and line breaks but does not sanitize path traversal sequences. The root cause is a Path Traversal weakness (CWE-22) combined with unsafe use of dirname() and a recursive deletion function (Util::rm()) that operates on the resolved traversed path. When an invalid file is uploaded, the cleanup handler calls dirname() on the traversed path, converting a path like '/var/www/html/wp-content/plugins/../../../tmp' into '/var/www/html/wp-content', which is then passed to the recursive delete function, resulting in deletion of unintended directories.
RemediationAI
Immediately upgrade JetBackup to a version released after 3.1.19.8 that includes proper input validation and path normalization. The primary fix requires patching the Upload::getFileLocation() method to use basename() to strip any directory components from the fileName parameter, ensuring the resolved file path remains within the intended upload directory. Additionally, validate that the resolved path is within the permitted directory using functions like realpath() and verifying the resolved path is a child of the intended directory. Apply strict input validation that rejects filenames containing '../', './', or any other path traversal sequences before concatenation. As a temporary compensating control pending patching, restrict administrator role access to users who absolutely require it, or disable the JetBackup file upload functionality entirely via code modification or plugin settings if available. However, disabling uploads may impact legitimate backup operations, so this should be a temporary measure only. Monitor and audit administrator account activity, particularly around file operations, to detect suspicious activity. These controls have trade-offs: restricting admin access may impact legitimate site maintenance, and disabling uploads prevents backup functionality until patched.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today