Search
Find a vulnerability
Search criteria
2 vulnerabilities by gilbertchen
CVE-2026-82264 (GCVE-0-2026-82264)
Vulnerability from nvd – Published: 2026-08-28 16:18 – Updated: 2026-08-28 20:28
VLAI
EPSS
VEX
Title
Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths
Summary
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 20:27 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/gilbertchen/duplicacy/issues/692 | issue-tracking |
| https://github.com/gilbertchen/duplicacy | product |
| https://github.com/gilbertchen/duplicacy/blob/54f… | technical-description |
| https://github.com/gilbertchen/duplicacy/blob/54f… | technical-description |
| https://www.vulncheck.com/advisories/duplicacy-pa… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gilbertchen | duplicacy |
Affected:
0 , ≤ 3.2.5
(semver)
|
Date Public
2026-08-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:27:54.568155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T20:28:04.153Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "duplicacy",
"vendor": "gilbertchen",
"versions": [
{
"lessThanOrEqual": "3.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:18:49.329Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #692",
"tags": [
"issue-tracking"
],
"url": "https://github.com/gilbertchen/duplicacy/issues/692"
},
{
"tags": [
"product"
],
"url": "https://github.com/gilbertchen/duplicacy"
},
{
"name": "Vulnerable code: duplicacy_utils_others.go",
"tags": [
"technical-description"
],
"url": "https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_utils_others.go"
},
{
"name": "Vulnerable code: duplicacy_backupmanager.go",
"tags": [
"technical-description"
],
"url": "https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_backupmanager.go"
},
{
"name": "VulnCheck Advisory: Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/duplicacy-path-traversal-during-restore-via-unsanitized-snapshot-paths"
}
],
"title": "Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82264",
"datePublished": "2026-08-28T16:18:49.329Z",
"dateReserved": "2026-08-28T11:12:36.348Z",
"dateUpdated": "2026-08-28T20:28:04.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-82264 (GCVE-0-2026-82264)
Vulnerability from cvelistv5 – Published: 2026-08-28 16:18 – Updated: 2026-08-28 20:28
VLAI
EPSS
VEX
Title
Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths
Summary
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.
Severity
6.8 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-28 20:27 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/gilbertchen/duplicacy/issues/692 | issue-tracking |
| https://github.com/gilbertchen/duplicacy | product |
| https://github.com/gilbertchen/duplicacy/blob/54f… | technical-description |
| https://github.com/gilbertchen/duplicacy/blob/54f… | technical-description |
| https://www.vulncheck.com/advisories/duplicacy-pa… | third-party-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| gilbertchen | duplicacy |
Affected:
0 , ≤ 3.2.5
(semver)
|
Date Public
2026-08-16 00:00
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-82264",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-28T20:27:54.568155Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T20:28:04.153Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "duplicacy",
"vendor": "gilbertchen",
"versions": [
{
"lessThanOrEqual": "3.2.5",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "George Chen"
}
],
"datePublic": "2026-08-16T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user."
}
],
"metrics": [
{
"cvssV4_0": {
"attackComplexity": "HIGH",
"attackRequirements": "PRESENT",
"attackVector": "NETWORK",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"privilegesRequired": "NONE",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "PASSIVE",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "HIGH",
"vulnConfidentialityImpact": "NONE",
"vulnIntegrityImpact": "HIGH"
},
"format": "CVSS"
},
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-28T16:18:49.329Z",
"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"shortName": "VulnCheck"
},
"references": [
{
"name": "GitHub Issue #692",
"tags": [
"issue-tracking"
],
"url": "https://github.com/gilbertchen/duplicacy/issues/692"
},
{
"tags": [
"product"
],
"url": "https://github.com/gilbertchen/duplicacy"
},
{
"name": "Vulnerable code: duplicacy_utils_others.go",
"tags": [
"technical-description"
],
"url": "https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_utils_others.go"
},
{
"name": "Vulnerable code: duplicacy_backupmanager.go",
"tags": [
"technical-description"
],
"url": "https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_backupmanager.go"
},
{
"name": "VulnCheck Advisory: Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths",
"tags": [
"third-party-advisory"
],
"url": "https://www.vulncheck.com/advisories/duplicacy-path-traversal-during-restore-via-unsanitized-snapshot-paths"
}
],
"title": "Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths",
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"cveMetadata": {
"assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
"assignerShortName": "VulnCheck",
"cveId": "CVE-2026-82264",
"datePublished": "2026-08-28T16:18:49.329Z",
"dateReserved": "2026-08-28T11:12:36.348Z",
"dateUpdated": "2026-08-28T20:28:04.153Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}