5.9
MediumCVSS 4.0 · from hackerone
CVE-2026-108140
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the…
Backup and Replication · Path traversal · CWE-22AffectedBackup and Replication
FixUpdate to 13.0.3, 13.1.2 or newer
PublishedOct 27, 16:16 · hackerone
ScoredOct 27 · 5.9 · hackerone
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, high privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
A successful attack can change data. CVSS impact.
Description
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
From hackerone
Affected and fixed versions
ProductAffectedFixed inBackup and Replication13.0 – before 13.0.313.0.3Backup and Replication13.1 – before 13.1.213.1.2
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known