EUVD-2026-47761
GHSA-2g48-2hgv-5jpv
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from Vendor (certcc) · only source for this CVE.
CVSS VectorVendor: certcc
Lifecycle Timeline
4DescriptionCVE.org
Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write to. A standard local user can overwrite any DLL in the service directory. On service restart, the OS loads the attacker's DLL before any managed code runs, executing arbitrary code as SYSTEM.
AnalysisAI
Local privilege escalation in Duplicati v2.3.0.1 allows an authenticated standard user to replace DLLs in the service directory when the software is installed outside the default Program Files path. On service restart, the Windows service loads the attacker-controlled DLL, granting arbitrary code execution as SYSTEM. No active exploitation is reported, and EPSS probability is low at 0.18%.
Share
External POC / Exploit Code
Leaving vuln.today