Path traversal in Synology Active Backup for Business
Priority LOW 30CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in agent-related functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to delete arbitrary files via unspecified vectors.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00572 47th percentileScored 2026-11-07
Fix Fixed Active Backup for Business (Synology): 2.7.1-3234, 2.7.1-13234, 2.7.1-23234
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Synology | Active Backup for Business | before 2.7.1-3234; before 2.7.1-13234; before 2.7.1-23234 | 2.7.1-3234, 2.7.1-13234, 2.7.1-23234 | Patch available | CNA |
- Active Backup for Business VendorSynology Affected before 2.7.1-3234; before 2.7.1-13234; before 2.7.1-23234 Fixed in 2.7.1-3234, 2.7.1-13234, 2.7.1-23234 Patch available CNA
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:synology:active_backup_for_business_agent:*:*:*:*:*:*:*:* | before 2.7.1-13234 | Vulnerable | Synology |
| cpe:2.3:o:synology:diskstation_manager:7.1:*:*:*:*:*:*:* | 7.1 | Running on | Synology |
| cpe:2.3:a:synology:active_backup_for_business_agent:*:*:*:*:*:*:*:* | before 2.7.1-3234 | Vulnerable | Synology |
| cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* | 6.2 | Running on | Synology |
| cpe:2.3:a:synology:active_backup_for_business_agent:*:*:*:*:*:*:*:* | before 2.7.1-23234 | Vulnerable | Synology |
| cpe:2.3:o:synology:diskstation_manager:7.2:*:*:*:*:*:*:* | 7.2 | Running on | Synology |
- cpe:2.3:a:synology:active_backup_for_business_agent:*:*:*:*:*:*:*:* Versions before 2.7.1-13234 Vulnerable ·Synology
- cpe:2.3:o:synology:diskstation_manager:7.1:*:*:*:*:*:*:* Versions 7.1 Running on ·Synology
- cpe:2.3:a:synology:active_backup_for_business_agent:*:*:*:*:*:*:*:* Versions before 2.7.1-3234 Vulnerable ·Synology
- cpe:2.3:o:synology:diskstation_manager:6.2:*:*:*:*:*:*:* Versions 6.2 Running on ·Synology
- cpe:2.3:a:synology:active_backup_for_business_agent:*:*:*:*:*:*:*:* Versions before 2.7.1-23234 Vulnerable ·Synology
- cpe:2.3:o:synology:diskstation_manager:7.2:*:*:*:*:*:*:* Versions 7.2 Running on ·Synology
Remediation
- Fix · CNA Active Backup for Business (Synology) Fixed in 2.7.1-3234, 2.7.1-13234, 2.7.1-23234
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
Synology Active Backup for Business — Synology-SA-25:02 Active Backup for Business
3 records Highest priority Priority LOW 3 LOW
Other records, highest priority first
- TI-2024-31600 Improper limitation of a pathname to a restricted directory ('Path Traversal')…Priority LOW 29
- TI-2024-31601 Path traversal in Synology Active Backup for BusinessPriority LOW 14
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47264
- 2026-10-03 Alias added: GHSA-f3gr-2wrv-hwpx
References
More Synology Active Backup For Business Agent vulnerabilities
- TI-2024-31600 Improper limitation of a pathname to a restricted directory ('Path Traversal')… CVSS 3.1MEDIUM 6.5
- TI-2025-40996 Origin validation error in Synology Active Backup for Business Agent CVSS 3.1MEDIUM 6.1
- TI-2023-29269 Missing authentication in Synology Active Backup for Business Agent CVSS 3.1MEDIUM 5.5
- TI-2023-29270 Missing encryption of sensitive data vulnerability in login component in Synology Active… CVSS 3.1MEDIUM 5.3
- TI-2023-29268 Missing encryption of sensitive data vulnerability in settings functionality in Synology… CVSS 3.1MEDIUM 5.0
- TI-2023-29267 Missing authentication in Synology Active Backup for Business Agent CVSS 3.1MEDIUM 4.0
Sources
- CVE-2024-47264 · CVE Program
- CVE-2024-47264 · NVD
- FIRST EPSS
- GHSA-f3gr-2wrv-hwpx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences