CVE-2026-82264

Received Received - Intake

Path Traversal in Duplicacy Restore Function

Publication date: 2026-08-28

Last updated on: 2026-08-28

Assigner: VulnCheck

Description

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-28

Generated

2026-08-29

AI Q&A

2026-08-29

EPSS Evaluated

N/A

NVD

CVE-2026-82264

EUVD

EUVD-2026-67795

Affected Vendors & Products

Vendor	Product	Version / Range
duplicacy	duplicacy	3.2.5

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Duplicacy through version 3.2.5 has a path traversal vulnerability in its restore function. The software fails to validate entry paths when deserializing data from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences like '../../' to write files outside the intended restore directory to any location accessible by the restoring user.

Detection Guidance

Check for Duplicacy versions up to 3.2.5 using commands like 'duplicacy version' or inspect installed packages. Monitor for unexpected file writes outside intended directories during restore operations. Review snapshot files for malicious path entries containing traversal sequences like '../'.

Impact Analysis

An attacker could place arbitrary files anywhere the restoring user has permissions, including sensitive locations like .ssh/authorized_keys. This could lead to remote code execution, privilege escalation, or data theft if the attacker writes malicious files to system directories.

Compliance Impact

This vulnerability could lead to unauthorized file writes, potentially violating data integrity and confidentiality requirements under GDPR and HIPAA. Unauthorized file access may result in data breaches, non-compliance with access controls, and failure to protect sensitive data.

Mitigation Strategies

Upgrade Duplicacy to the latest patched version immediately. Avoid restoring snapshots from untrusted sources. Implement strict access controls on snapshot storage to prevent unauthorized modifications. Monitor file system writes during restore operations for suspicious activity.

Hi! I’m here to help you understand CVE-2026-82264. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70