CVE WatchSep 24, 2026

CVE-2024-48248

NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

CVSS

8.6

High

EPSS

94.4%

p100

KEV

YES

Mar 19, 2025

Exploit Today

0-100

Published: Mar 4, 2025 · Last modified: Sep 24, 2026 · CWE-36

EPSS · 30d

94.4%EPSS · 30 days94.4%

2026-09-162026-10-14

KEV catalog record

Product

NAKIVO / Backup and Replication

Vulnerability

NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

Added to KEV

Mar 19, 2025

Remediate by

Apr 9, 2025

Known ransomware use

Summary description

NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.

Required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://helpcenter.nakivo.com/Release-Notes/Content/Release-Notes.htm ; https://nvd.nist.gov/vuln/detail/CVE-2024-48248

Technical description

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-837848.8 HIG

60.5%

——18Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to elevate privileges over a network.2d CVE-2026-837468.1 HIG

62.5%

——19Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to elevate privileges over a network.2d CVE-2026-836836.5 MED

65.8%

——20Absolute path traversal in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information over a network.2d CVE-2026-702978.8 HIG

62.8%

——19Absolute path traversal in Skype for Business and Microsoft Lync allows an authorized attacker to execute code over a network.2d CVE-2026-55062—

8.1%

——2uniget is a universal installer and updater for (container) tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed to the configured editor, which can access or modify files outside the hooks directory with the privileges of the uniget process account. This issue is fixed in version 0.27.6.22d CVE-2025-708203.5 LOW

7.4%

——2Zettlab D6 Ultra before 1.7.0 allows absolute path traversal to reach folders other than the personal folder.23h