CVE-2026-16157

Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write...

CVE-2026-16157

CVE-2026-16157 affects Duplicati v2.3.0.1 on Windows. The MSI installer registers a LocalSystem service that executes binaries from the installation directory. If installed to a non-default path (outside the default C:\Program Files\Duplicati 2), a standard local user can write to the service dir...

CVE-2026-16157 Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Duplicati v2.3.0.1 backup software gives Authenticated Users MODIFY permissions that propagate to all subdirectories. Installing the software outside of the Program Files directory, or on a custom path, creates a LocalSystem service running from a directory that any standard local user can write...

Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Overview Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious file...

PT-2026-63440

Name of the Vulnerable Software and Affected Versions Duplicati version 2.3.0.1 Description Incorrect permission assignments allow authenticated users to have MODIFY permissions that propagate to all subdirectories. When the software is installed outside the default Program Files directory or on ...