Executive brief
Duplicati is a backup tool for Windows that loads backup configurations at startup. An attacker with local access to a computer can create a malicious configuration file that grants them full system-level privileges (NT AUTHORITY\SYSTEM), potentially allowing them to take complete control of the machine and access all data stored on it.
Technical details
The vulnerability is an incorrect permission assignment (CWE-276) in Duplicati's configuration loader, specifically in the preload.json file handling. A local, low-privileged attacker can craft a malicious preload.json file in a location where Duplicati reads it during startup. Because the configuration loader does not properly validate file permissions or content, the attacker-controlled file is executed with SYSTEM privileges, resulting in privilege escalation. The attack requires local file system access but no prior authentication. This vulnerability affects Duplicati for Windows versions before v2.4.0.0, and patches are available in v2.4.0.0 and later.
Affected products
- Duplicati Duplicati before v2.4.0.0
Timeline
- 2026-09-15: disclosed