CVE-2024-47273
Path Traversal in Synology Hyper Backup
Publication date: 2026-06-03
Last updated on: 2026-06-03
Assigner: Synology Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| synology | hyper_backup | 4.1.2-4036 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-22 | The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Path Traversal issue in the Backup Task functionality of Synology Hyper Backup versions before 4.1.2-4036. It allows remote authenticated users to write specific files outside the intended restricted directory by exploiting improper limitation of the pathname.
How can this vulnerability impact me? :
An attacker who is remotely authenticated can write files to locations they should not have access to. This could lead to unauthorized modification of files, potentially compromising the integrity of the backup system or other parts of the affected system.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Synology Hyper Backup allows remote authenticated users to write specific files via path traversal, which could potentially lead to unauthorized modification of backup data.
Such unauthorized file modifications may impact the integrity and security of backup data, which are critical aspects of compliance with standards like GDPR and HIPAA that require protection of sensitive data and ensuring data integrity.
However, the provided information does not explicitly describe the direct impact of this vulnerability on compliance with these regulations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should update Synology Hyper Backup to version 4.1.2-4036 or later, as this version addresses the improper limitation of pathname in the Backup Task functionality.