CVE-2024-48248

The vulnerability in NAKIVO Backup & Replication prior to version 11.0.0.88174 is characterized by an absolute path traversal flaw that allows unauthorized access to files on the server. This issue arises from improper input validation in the `getImageByPath` function, which permits attackers to manipulate file paths and potentially access sensitive files stored on the server. By exploiting this vulnerability, an attacker can read arbitrary files, including configuration files that may contain cleartext credentials. The implications of this flaw are severe, as it can facilitate further attacks, including remote code execution, thereby compromising the integrity and confidentiality of the entire enterprise environment.

Attack vectors for this vulnerability are particularly concerning due to the ease of exploitation. An attacker could leverage a simple HTTP request to the affected endpoint, manipulating the file path parameter to traverse directories and access sensitive files. For instance, by crafting a request that includes directory traversal sequences (e.g., `../../`), an attacker can navigate the file system and retrieve files that should be restricted. Once access is gained to files containing cleartext credentials, the attacker could utilize these credentials to gain unauthorized access to other systems within the network, leading to a broader compromise. This scenario highlights the potential for a single vulnerability to serve as a gateway for extensive exploitation across an organization.

The real-world impact of this vulnerability is significant, particularly for organizations relying on NAKIVO Backup & Replication for their data protection strategies. The risk extends beyond mere data exposure; the ability to execute arbitrary code remotely can lead to full system compromise. This could result in data loss, financial repercussions, and reputational damage. Organizations may face regulatory scrutiny if sensitive data is exposed due to inadequate security measures. The potential for attackers to leverage this vulnerability to pivot to other systems within the network further amplifies the business risk, making it imperative for organizations to address this issue promptly.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-faceted approach. Regular vulnerability assessments and penetration testing can help identify weaknesses in their systems, including this specific flaw. Monitoring network traffic for unusual patterns or unauthorized access attempts can also provide early warning signs of exploitation. Additionally, organizations should ensure that they are running the latest version of NAKIVO Backup & Replication, as updates often include critical security patches that address known vulnerabilities. Implementing strict access controls and employing the principle of least privilege can further reduce the attack surface, limiting the potential impact of any exploitation attempts.

In conclusion, the path traversal vulnerability in NAKIVO Backup & Replication presents a serious threat to organizations that utilize this software for backup and data protection. The ease of exploitation, coupled with the potential for remote code execution, underscores the need for immediate attention. By adopting proactive security measures, organizations can mitigate the risks associated with this vulnerability and protect their critical data assets from unauthorized access and exploitation.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the path traversal vulnerability in NAKIVO Backup & Replication Director. Although the overall EPSS score remains high but stable, our telemetry indicates the emergence of at least one new exploitation instance, signaling that adversaries are actively probing or leveraging this flaw. This development is significant because it confirms the vulnerability’s transition from theoretical risk to practical exploitation, increasing the likelihood of unauthorized access to sensitive backup files and potential remote code execution within affected environments. While no ransomware campaigns have yet been linked to this vulnerability, the presence of cleartext credentials in the PhysicalDiscovery component elevates the threat’s severity, as attackers could pivot to broader enterprise compromise. Consequently, the threat level should be considered elevated, with defenders needing heightened vigilance for indicators of compromise related to this vulnerability.

Update 2 — June 19, 2026

CSURFACE threat intelligence has detected a marked escalation in activity related to CVE-2024-48248, with telemetry indicating a doubling in exploitation attempts targeting the absolute path traversal vulnerability in NAKIVO Backup & Replication Director. This uptick is accompanied by a slight increase in the EPSS score, reflecting growing confidence in the exploitability of this flaw. Although no ransomware campaigns have been definitively linked to this vulnerability, the increased detection frequency underscores a shift from opportunistic scanning toward more targeted exploitation efforts. The presence of cleartext credentials within the PhysicalDiscovery component continues to amplify the risk, as successful exploitation could enable attackers to execute remote code and move laterally within enterprise environments. Consequently, the threat level for CVE-2024-48248 should be considered elevated, with defenders advised to maintain heightened awareness for related indicators of compromise given the evolving exploitation landscape.

Update 3 — July 06, 2026

CSURFACE threat intelligence has identified a slight increase in activity linked to CVE-2024-48248, reflected in a modest uptick in telemetry detections and a marginal rise in the EPSS score. This subtle escalation suggests adversaries are incrementally intensifying their efforts to exploit the absolute path traversal vulnerability within NAKIVO Backup & Replication Director. Although no new proof-of-concept exploits have surfaced, the persistence of cleartext credentials in the PhysicalDiscovery component continues to present a critical attack vector, potentially enabling remote code execution and lateral movement within compromised environments. The incremental rise in exploitation attempts signals a gradual shift from opportunistic scanning toward more deliberate targeting, underscoring the need for defenders to remain vigilant. Consequently, the threat level for CVE-2024-48248 remains high, with a slight elevation in risk due to the evolving exploitation dynamics observed in our telemetry.