CVE-2025-41757CWE-22

Arbitrary Write with ubr-restore

High · published March 9, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

A low-privileged remote attacker can abuse the backup restore functionality of UBR (ubr-restore) which runs with elevated privileges and does not validate the contents of the backup archive to create or overwrite arbitrary files anywhere on the system.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00563 · 46.1th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-03-09T08:16Z
EPSS history
Timeline
  • 09 MAR 08:16Z
    Arbitrary Write with ubr-restore
    cvelistv5