What’s Vulnerable › Vulnerabilities

CVE-2026-82264: Duplicacy Path Traversal during Restore via Unsanitized Snapshot Paths

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-28 · updated 2026-09-23
• Weakness: CWE-22

Description

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.

Affected products

• gilbertchen duplicacy: through 3.2.5

References

• https://github.com/gilbertchen/duplicacy
• https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_backupmanager.go
• https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_utils_others.go
• https://github.com/gilbertchen/duplicacy/issues/692
• https://www.vulncheck.com/advisories/duplicacy-path-traversal-during-restore-via-unsanitized-snapshot-paths

Get alerted when CVE-2026-82264 or the next vulnerability affects your stack