Authenticated Local Privilege Escalation in Duplicati Backup Software

Executive Summary

CVE-2026-16157 is a vulnerability in Duplicati v2.3.0.1 backup software where authenticated users gain MODIFY permissions that extend to all subdirectories. Installing the software outside the default Program Files directory creates a LocalSystem service running from a writable directory by standard users. Attackers can overwrite DLLs in this directory, and upon service restart, the malicious DLL executes arbitrary code with SYSTEM privileges.

Useful 0 Not Useful 0

Detection Guidance

Check if Duplicati is installed outside the default directory (C:\Program Files\Duplicati 2\). Verify if the installation directory allows standard users to write files. Inspect service permissions and ACLs for the Duplicati service directory.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows a local attacker with standard user privileges to execute arbitrary code as SYSTEM. If Duplicati is installed outside the default directory, the attacker can overwrite DLLs in the service directory. When the service restarts, the malicious DLL is loaded, granting full control over the system.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized code execution with SYSTEM privileges, potentially compromising data confidentiality and integrity. For GDPR, it may result in unauthorized access to personal data, violating Article 32 (security of processing). For HIPAA, it could allow unauthorized access to protected health information, violating the Security Rule. Organizations using Duplicati in non-default installations may fail to meet compliance requirements for access controls and audit logging.

Useful 0 Not Useful 0

Mitigation Strategies

Install Duplicati in the default directory (C:\Program Files\Duplicati 2\) to apply protective ACLs. If a non-default installation is required, manually configure equivalent permissions. Monitor for vendor patches and apply them once available.

Useful 0 Not Useful 0