CVE-2025-9120
Code Injection in OpenText Carbonite Safe Server Backup Allows Unauthorized Access
Publication date: 2026-02-24
Last updated on: 2026-02-24
Assigner: OpenText
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| opentext | carbonite_safe_server_backup | to 6.8.4 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-94 | The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
The recommended mitigation is to upgrade Carbonite Safe Server Backup to version 6.8.4 or later.
For further assistance, users are advised to contact Carbonite support via the My Support Portal.
Can you explain this vulnerability to me?
CVE-2025-9120 is a remote code execution (RCE) vulnerability in OpenText™ Carbonite Safe Server Backup, specifically affecting versions 6.8.3 and earlier.
The vulnerability arises from improper control of code generation, also known as code injection, which can be exploited through an open port.
This means an attacker could potentially execute arbitrary code on the affected system without authorization.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to gain unauthorized access to your system by exploiting an open port.
Once exploited, the attacker could execute arbitrary code remotely, potentially leading to system compromise, data loss, or further malicious activity.