NAKIVO Backup & Replication: Unauthenticated absolute path traversal via getImageByPath

Impact

Unauthenticated absolute path traversal via getImageByPath -> arbitrary file read incl. cleartext credentials

Who can reach it

Network (remote)

What to do

Control-plane: patch + rotate all credentials in the backup product database

References

Related entries

• Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP): A large cluster of unauthenticated ModbusCVE-2024-48882 · Socomec DIRIS Digiware M-70 1.6.9 (Modbus TCP and Modbus RTU-over-TCP)High
• Ivanti Endpoint Manager (EPM): Auth bypass via alternate pathCVE-2026-1603 · Ivanti Endpoint Manager (EPM)High
• Pure Storage FlashArray Purity (management interface privilege bypass): An authenticated low-privileged user reachesCVE-2026-6444 · Pure Storage FlashArray Purity (management interface privilege bypass)High
• rclone (serve restic): Path validation in serve restic is incomplete, so an authenticated caller escapes the configuredCVE-2026-71309 · rclone (serve restic)High
• LibreNMS: device hostname is concatenated into shell commands in libvirt discovery, giving RCECVE-2026-84194 · LibreNMS libvirt VM discovery (VminfoLibvirt.php)High
• VMware Aria Automation (SQL injection): An authenticated user injects SQL and performs unauthorized read/writeCVE-2024-22280 · VMware Aria Automation (SQL injection)High