EUVD-2026-42244
GHSA-6rx8-5c7f-4wh3
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N
High privilege required for exploitation; only limited file write outside restricted path; no confidentiality or availability impact confirmed by description.
Primary rating from Vendor (emc).
CVSS VectorVendor: emc
Lifecycle Timeline
2DescriptionCVE.org
Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1.0 through 8.3.1.30, LTS2024 release versions 7.13.1.0 through 7.13.1.70 contain an improper limitation of a pathname to a restricted directory ('path traversal') vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to unauthorized file modification.
AnalysisAI
Unauthorized file modification in Dell PowerProtect Data Domain allows a high-privileged remote attacker to write files outside the intended restricted directory via path traversal. Affected across multiple release trains spanning versions 7.7.1.0 through 8.7, including LTS2024, LTS2025, and LTS2026 branches. Dell has published advisory DSA-2026-278 addressing this flaw; no public exploit code or active exploitation has been identified at time of analysis.
Technical ContextAI
CWE-22 (Improper Limitation of a Pathname to a Restricted Directory, also known as Path Traversal) describes a root cause where user-supplied input containing directory traversal sequences (e.g., '../') is not properly sanitized before being used to construct file system paths. Dell PowerProtect Data Domain is an enterprise data protection and deduplication appliance commonly used for backup target storage. The vulnerability exists within a remotely accessible component of the management or data-path interface, where crafted path input allows writes to escape the intended directory boundary. The CVSS vector AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N confirms the flaw is reachable over the network, requires no user interaction, has low attack complexity once authenticated, but demands high-privilege credentials. The scope is unchanged, and impact is limited to a low integrity effect with no confidentiality or availability consequences.
RemediationAI
The primary remediation is to apply the patched firmware or software version released by Dell as part of advisory DSA-2026-278, available at https://www.dell.com/support/kbdoc/en-us/000481268/dsa-2026-278-security-update-for-dell-powerprotect-data-domain-multiple-vulnerabilities. Exact fixed version numbers should be confirmed directly from that advisory, as they are not independently specified in the available intelligence data. As a compensating control prior to patching, organizations should enforce strict role-based access control to limit the number of accounts with high-privilege access to the Data Domain management interface, and review audit logs for anomalous file system activity by privileged users. Network-level access restrictions - such as placing the management interface behind a jump host or limiting IP allowlists - can reduce exposure, though the flaw requires authentication, so this provides defense-in-depth rather than prevention. Note that restricting management access may affect operational workflows for backup administrators.
More in Data Domain Operating System
View allDell PowerProtect Data Domain with Data Domain Operating System (DD OS) versions prior to 8.3.0.15 contain an Insufficie
Improper authorization enforcement in Dell PowerProtect Data Domain (versions 7.7.1.0 through 8.6, plus LTS branches 8.6
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 contain an OS command injection v
Dell PowerProtect DD, version(s) 8.0, 7.13.1.0, 7.10.1.30, 7.7.5.40, contain(s) an Out-of-bounds Write vulnerability. Ra
Denial of service in Dell PowerProtect Data Domain (DDOS versions 7.7.1.0 through 8.7, plus LTS2026 8.6.1.0-8.6.1.10, LT
Dell PowerProtect Data Domain, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an escalation of
Dell PowerProtect DD, versions prior to 8.1.0.0, 7.13.1.10, 7.10.1.40, and 7.7.5.50, contains an access control vulnerab
Stored cross-site scripting in Dell PowerProtect Data Domain (DD OS 7.7.1.0 through 8.7, plus the LTS2026 8.6.1.x, LTS20
Dell PowerProtect DD, versions prior to 8.0, LTS 7.13.1.0, LTS 7.10.1.30, LTS 7.7.5.40 on DDMC contain a relative path t
OS command injection in Dell PowerProtect Data Domain enables a high-privileged local attacker to execute arbitrary oper
OS command injection in Dell PowerProtect Data Domain across four version release trains allows a high-privileged remote
Dell PowerProtect Data Domain with Data Domain Operating System (DD OS) of Feature Release versions 7.7.1.0 through 8.4.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today