CVE-2026-82264CWE-22path-traversal

CVE-2026-82264

Medium · published August 29, 2026

CVSS v3.1
6.8
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
CVSS v4.0
6.1 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00710 · 53.0th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-29T00:20Z
References (5)
https://github.com/gilbertchen/duplicacy · [email protected]https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_backupmanager.go · [email protected]https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_utils_others.go · [email protected]https://github.com/gilbertchen/duplicacy/issues/692 · [email protected]https://www.vulncheck.com/advisories/duplicacy-path-traversal-during-restore-via-unsanitized-snapshot-paths · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 1%
    epss
  • 28 AUG 16:18Z
    Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths
    cvelistv5