PT-2026-1822

Name of the Vulnerable Software and Affected Versions Veeam Backup & Recovery versions prior to 13.0 Description The issue allows a Backup or Tape Operator to write files as root, leading to potential privilege escalation. Multiple reports indicate this is a critical security concern...

PT-2026-1817

Name of the Vulnerable Software and Affected Versions Veeam Backup & Replication versions prior to 13.0.1.1071 Description The software contains a flaw that permits a Backup or Tape Operator to execute code remotely as root by crafting a malicious backup configuration file. Recommendations Update...

REDAXO 安全漏洞

REDAXO is a content management system of REDAXO open source. A security vulnerability exists in REDAXO versions prior to 5.20.2, which stems from a path traversal in the file export function of the Backup add-on, which could cause a user with backup privileges to read arbitrary files in the webro...

PT-2026-1821

Name of the Vulnerable Software and Affected Versions Veeam affected versions not specified Description The software contains a flaw that enables a Backup Administrator to execute code remotely as the postgres user. This is achieved by submitting a crafted password parameter. The issue allows for...

CVE-2025-5965

In the backup parameters, a user with high privilege is able to concatenate custom instructions to the backup setup. Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Centreon Infra Monitoring Backup configuration in the administration setup...

Improper Authentication

Signal K Server is vulnerable to Improper Authentication. The vulnerability is due to unauthenticated modification of internal server state via the /skServer/validateBackup endpoint, which allows an attacker to overwrite critical configuration files and hijack the administrator restore process to...

SUSE CVE-2025-67818

An issue was discovered in Weaviate OSS before 1.33.4. An attacker with access to insert data into the database can craft an entry name with an absolute path e.g., /etc/... or use parent directory traversal ../../.. to escape the restore root when a backup is restored, potentially creating or...

Vulnerabilities Resolved in Veeam Backup & Replication 13.0.1.1071

All vulnerabilities documented in this article were resolved in Veeam Backup & Replication 13.0.1.1071. Veeam Product Latest Version Download Page Veeam Software Security Commitment Veeam® is committed to ensuring its products protect customers from potential risks. As part of that commitment, we...

MAL-2026-923 Malicious code in auto-backup-linux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6f1fce241db64e9804a2eee083721b8374a2f27d8f4f2c51ce77a8e7687c61e Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...

Malicious code in auto-backup-linux (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e6f1fce241db64e9804a2eee083721b8374a2f27d8f4f2c51ce77a8e7687c61e Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...

MAL-2026-924 Malicious code in auto-backup-macos (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64b97d3c3597539dc5a2cc2d81491eb2a0350011b3d80ef927546bc30701f924 Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...

Malicious code in auto-backup-macos (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64b97d3c3597539dc5a2cc2d81491eb2a0350011b3d80ef927546bc30701f924 Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...

MAL-2026-926 Malicious code in auto-backup-wsl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a2df4191bfbdaa28acd42677c912064639ef3b278179beee064cd83fb5b0e11e Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...

MAL-2026-925 Malicious code in auto-backup-wins (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c75087101c3ef272d35e87c1e17c5455e788fec5b5aabb6a61c42362a180b30e Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...

Malicious code in auto-backup-wins (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c75087101c3ef272d35e87c1e17c5455e788fec5b5aabb6a61c42362a180b30e Package performs a "backup" of files to a remote location. This functionality is clearly described, but the user has no control over the remote location where...

CVE-2025-68456

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update ...

CVE-2025-68456 Unauthenticated Craft CMS users can trigger a database backup

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update ...

CVE-2025-68456 Unauthenticated Craft CMS users can trigger a database backup

Craft is a platform for creating digital experiences. In versions 5.0.0-RC1 through 5.8.20 and 3.0.0 through 4.16.16, unauthenticated users can trigger database backup operations via specific admin actions, potentially leading to resource exhaustion or information disclosure. Users should update ...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the EXPDIR POST parameter in the Backup addon. An authenticated attacker can access sensitive files within the webroot by supplying crafted directory traversal sequences, potentially leading to disclosure of...

Redaxo has Path Traversal in Backup Addon Leading to Arbitrary File Read

Summary Authenticated users with backup permissions can read arbitrary files within the webroot via path traversal in the Backup addon's file export functionality. Details The Backup addon does not validate the EXPDIR POST parameter against the UI-generated allowlist of permitted directories. An...