Executive brief
Duplicati, a popular open-source backup software, contains a security flaw when installed in custom locations outside of the standard Program Files folder. This flaw allows a standard user on a computer to replace application files with malicious ones. Because the software runs with high-level system privileges, an attacker can take full control of the computer, potentially leading to data theft or complete system compromise.
Technical details
Duplicati v2.3.0.1 is vulnerable to local privilege escalation due to incorrect permission assignment (CWE-211) during installation. When installed in a custom path or outside of 'C:\Program Files\', the installer grants 'Modify' permissions to 'Authenticated Users' that propagate to all subdirectories. Since the application registers a service running as LocalSystem, a local attacker can perform a DLL hijacking attack by overwriting or placing a malicious DLL in the service directory. Upon service restart, the OS loads the attacker's DLL, executing arbitrary code with NT AUTHORITY\SYSTEM privileges. Users are advised to use the default installation path or manually restrict ACLs.
Affected products
- Duplicati Duplicati 2.3.0.1
Timeline
- 2026-06-12: other: Vendor notified
- 2026-07-22: disclosed: Vulnerability disclosed by CERT/CC
- 2026-07-22: advisory: NVD record published