CVE-2024-48248
NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).
Scoring
- Severity
- HIGH
- CVSS base score
- 8.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
- EPSS probability
- 94.36%
- CISA KEV
- Known exploited vulnerability
- CWE
- CWE-36
- Published
- 2025-03-04
- Last modified
- 2025-10-21
Affected products
- NAKIVO Backup & Replication Director
Weakness type
Related vulnerabilities
- CVE-2026-68896 — Microsoft Windows Search Component Elevation of Privilege Vulnerability
- CVE-2026-69612 — Windows Error Reporting Elevation of Privilege Vulnerability
- CVE-2026-47630 — NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an...
- CVE-2026-47606 — NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an...
- CVE-2026-46345 — compliance-trestle - jinja has an Arbitrary File Write via Path Traversal
- CVE-2026-47243 — Kata guest escape: runtime-rs guest-root to host-root escape via virtiofs
- CVE-2026-54202 — TeamDavid: Path Traversal in the archive creation functionality
- CVE-2026-61891 — In Eclipse Theia versions up to and including 1.73.1, the `@theia/filesystem` backend exposes HTTP...