Executive brief
Duplicacy is a cloud backup tool that restores files from snapshot backups. A vulnerability in the restore function fails to validate file paths, allowing attackers with access to snapshot files to craft malicious entries that extract files outside the intended restore directory to arbitrary locations on the system. This could lead to unauthorized file writes and system compromise.
Technical details
The vulnerability is a path traversal flaw in the restore function where entry paths deserialized from snapshot files are not properly validated. Attackers can craft malicious snapshot files containing directory traversal sequences (e.g., "../") in file path entries to bypass restore directory boundaries. When a user restores from a compromised snapshot, files are written to arbitrary locations accessible by the restoring user. The attack requires the attacker to control or modify the snapshot file before restoration, or for a user to restore from an untrusted snapshot source. No authentication bypass is required once a malicious snapshot is processed.
Affected products
- Duplicacy Duplicacy through 3.2.5
Timeline
- 2026-08-28: disclosed