CVE-2025-5474: SyncBackFree Privilege Escalation Vulnerability

CVE-2025-5474 Overview

CVE-2025-5474 is a local privilege escalation vulnerability in 2BrightSparks SyncBackFree, a Windows file synchronization and backup utility. The flaw resides in the Mirror functionality and stems from improper handling of filesystem link structures [CWE-59]. A low-privileged attacker who can execute code on the target system can abuse the service to delete arbitrary files by planting a junction. Successful exploitation allows the attacker to escalate privileges and execute code in the context of SYSTEM. Exploitation requires user interaction from an administrator. The issue was reported through the Zero Day Initiative as ZDI-CAN-26962.

Critical Impact
An authenticated local attacker can escalate to SYSTEM by leveraging a junction to trigger arbitrary file deletion through the SyncBackFree Mirror operation.

Affected Products

2BrightSparks SyncBackFree
2BrightSparks SyncBackFree version 11.3.87.0
Windows installations running the affected SyncBackFree build

Discovery Timeline

2025-06-06 - CVE-2025-5474 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5474

Vulnerability Analysis

The vulnerability is a link following flaw [CWE-59] in the Mirror functionality of SyncBackFree. During a mirror operation, the application performs file system actions on paths that are not validated for symbolic links or NTFS junctions before use. An attacker who controls a directory referenced during the mirror workflow can redirect the operation to a target outside that directory. Because the operation runs with elevated privileges when the administrator triggers the sync, the resulting file deletion executes with those elevated rights. Arbitrary file deletion on Windows is a well-known primitive for full privilege escalation to SYSTEM through techniques that abuse Windows Installer rollback scripts and similar mechanisms.

Root Cause

The root cause is the absence of link resolution checks before performing privileged file operations. SyncBackFree follows NTFS junctions when it processes source or destination paths during Mirror actions. It does not verify that path components belong to the low-privileged user before acting on them.

Attack Vector

Exploitation requires local access with low privileges and user interaction from an administrator who runs the mirror job. The attacker plants a junction inside a directory processed by the mirror operation, pointing to a sensitive file or directory. When the administrator triggers the sync, SyncBackFree follows the junction and deletes the target on behalf of the attacker. The attacker then chains the arbitrary file deletion primitive into code execution as SYSTEM.

No public proof-of-concept code is available. Refer to the Zero Day Initiative Advisory ZDI-25-322 for additional technical detail.

Detection Methods for CVE-2025-5474

Indicators of Compromise

Creation of NTFS junctions or symbolic links under directories that appear in SyncBackFree Mirror profiles, especially by non-administrative users.
Unexpected deletion of files in privileged locations such as C:\Windows, C:\Program Files, or service configuration directories following a scheduled or manual SyncBackFree run.
SyncBackFree log entries showing file operations against paths outside the intended sync scope.

Detection Strategies

Monitor process activity from SyncBackFree.exe for file deletions on paths outside user-writable directories.
Alert on mklink /J command execution or CreateSymbolicLink/DeviceIoControl reparse point creation by standard users in staging directories.
Correlate administrator-initiated SyncBackFree runs with subsequent SYSTEM-level process creation events that lack a legitimate parent chain.

Monitoring Recommendations

Enable Windows object access auditing on directories used as SyncBackFree source or destination paths.
Capture Sysmon Event ID 11 (FileCreate) and Event ID 23 (FileDelete) for SyncBackFree.exe and review anomalies.
Review scheduled task and service configurations tied to SyncBackFree profiles for tampering.

How to Mitigate CVE-2025-5474

Immediate Actions Required

Update SyncBackFree to a version later than 11.3.87.0 once 2BrightSparks publishes a fixed release.
Restrict use of SyncBackFree Mirror profiles to source and destination directories that are not writable by non-administrative users.
Avoid running SyncBackFree interactively as an administrator on multi-user endpoints until a patch is applied.

Patch Information

At the time of publication, no vendor advisory URL is listed in the NVD entry. Monitor the 2BrightSparks release notes and the Zero Day Initiative Advisory ZDI-25-322 for updated fix availability. Apply the fixed build across all endpoints running SyncBackFree.

Workarounds

Configure SyncBackFree profiles to use directories with ACLs that deny write access to standard users.
Disable or remove SyncBackFree from shared or multi-user systems where local low-privileged accounts exist.
Use Windows FSRM or Group Policy to block junction creation by non-administrative users in directories referenced by backup jobs.

bash

# Example: remove non-admin write access on a SyncBackFree source directory
icacls "C:\Backups\Source" /inheritance:r
icacls "C:\Backups\Source" /grant:r "Administrators:(OI)(CI)F" "SYSTEM:(OI)(CI)F"
icacls "C:\Backups\Source" /remove "Users" "Authenticated Users"