CVE-2026-82264: Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths
Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.
Affected Software
Event History
Frequently Asked Questions
Which versions should be treated as affected?
Duplicacy through version 3.2.5 is affected. The provided information does not identify a fixed version.
What conditions are required for exploitation?
An attacker must provide a crafted snapshot containing malicious entry paths and induce a user to restore it. No attacker privileges are required, but user interaction is required.
What is the practical impact on the restoring system?
A malicious restore can write files outside the selected restore directory, to locations that the restoring user is permitted to access. This can compromise integrity and availability, while no confidentiality impact is indicated.