Read the docs
TI-2026-81411 Aliases CVE-2026-108140GHSA-448h-x64h-4j7h

Veeam Backup and Replication path traversal allows file write

Priority LOW 26CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Veeam Backup and Replication from 13.0 before 13.0.3 and from 13.1 before 13.1.2 is affected. Relative path traversal lets an authenticated user with the Restore Operator role who controls the contents of a backed-up NAS share write attacker-controlled files to an arbitrary path on the backup server (CWE-22). Exploitation requires high privileges and attack requirements (AT:P), and the impact on confidentiality is none while integrity and availability are affected. The flaw is not listed in CISA KEV and no public exploit is linked.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00357 29th percentileScored 2026-11-07
Fix Fixed Backup and Replication (Veeam): 13.0.3, 13.1.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
VeeamBackup and Replication13.0 to before 13.0.3; 13.1 to before 13.1.213.0.3, 13.1.2Patch availableCNA
  • Backup and Replication VendorVeeam Affected 13.0 to before 13.0.3; 13.1 to before 13.1.2 Fixed in 13.0.3, 13.1.2 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:*——Veeam
  • cpe:2.3:a:veeam:veeam_backup_\&_replication:*:*:*:*:*:*:*:* Versions — — ·Veeam

Remediation

Update Veeam Backup and Replication to 13.0.3 or 13.1.2. The sources list no advisory identifier for this fix.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA Backup and Replication (Veeam) Fixed in 13.0.3, 13.1.2

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Veeam Backup and Replication 13.0.3, 13.1.2

    3 records Highest priority Priority LOW 3 LOW

    Other records, highest priority first

    • TI-2026-81413 Authorization bypass in Veeam Backup and Replication CDP Coordinator ServicePriority LOW 39
    • TI-2026-81412 Veeam Backup and Replication path traversal enables arbitrary file writePriority LOW 26
    Show all 3 records →

Timeline

  1. 2026-10-27 Threatist record created from CVE-2026-108140
  2. 2026-10-27 Alias added: GHSA-448h-x64h-4j7h
  3. 2026-10-28 Priority changed: MEDIUM → LOW
  4. 2026-11-04 CISA SSVC decision points changed

References

Other 1

  • TI-2024-27107 Deserialization of untrusted data in Veeam Backup and Recovery KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09844 Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2). KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09843 Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and… KEVCVSS 3.1HIGH 8.8
  • TI-2023-12256 Missing authentication in Veeam Backup & Replication KEVCVSS 3.1HIGH 7.5
  • TI-2020-08796 Deserialization of untrusted data in Veeam One Agent CVSS 3.1CRITICAL 9.8
  • TI-2024-19623 Veeam Backup Enterprise Manager allows unauthenticated users to log in as any user to enterprise manager web interface. CVSS 3.0CRITICAL 9.8
See all 119 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences