EUVD-2026-67795
GHSA-8q34-4phx-mc2v
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H because attacker must pre-compromise backend storage; UI:R since victim must perform restore; S:C for writes escaping restore sandbox; A:H because overwriting system files can cause unavailability.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
1DescriptionCVE.org
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.
AnalysisAI
Path traversal in Duplicacy's restore function through version 3.2.5 allows arbitrary file writes outside the designated restore directory when a user restores from a compromised or attacker-controlled snapshot repository. Duplicacy fails to sanitize file paths deserialized from snapshot entries, so crafted traversal sequences (e.g., '../../') cause files to be written to any location accessible by the restoring OS user. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two concrete prerequisites: first, the attacker must have write access to a Duplicacy snapshot repository that the victim will restore from - this means either compromising the storage backend credentials, being a malicious insider with storage access, or socially engineering a victim into restoring from an attacker-controlled repository; second, the victim user must actively initiate a restore operation from that compromised repository. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.1 reflects a meaningful but constrained threat: High integrity and availability impact is tempered by High complexity (AC:H) and Attack Requirements Present (AT:P), acknowledging that exploitation depends on the attacker having already achieved write access to a snapshot repository the victim trusts. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patched version has been confirmed in available data. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today