CVE-2026-82264: Duplicacy Path Traversal Vulnerability

CVE-2026-82264 Overview

CVE-2026-82264 is a path traversal vulnerability [CWE-22] affecting Duplicacy backup software through version 3.2.5. The restore function fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries containing directory traversal sequences to write files outside the intended restore directory. The write operation executes with the privileges of the restoring user, allowing files to land at arbitrary filesystem locations accessible to that account.

Critical Impact
A malicious snapshot can overwrite user configuration files, SSH keys, shell startup scripts, or other sensitive files during restore, leading to integrity loss and potential code execution under the restoring user's identity.

Affected Products

Duplicacy backup manager (all versions through 3.2.5)
Deployments consuming untrusted or attacker-influenced snapshot repositories
Systems where restore operations run under privileged user accounts

Discovery Timeline

2026-08-28 - CVE-2026-82264 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-82264

Vulnerability Analysis

Duplicacy stores backup metadata in snapshot files that describe each entry's path, size, and content chunks. During restore, the backup manager deserializes these entries and writes their contents to disk relative to a user-supplied restore directory. The vulnerable code in duplicacy_backupmanager.go does not verify that each deserialized path stays within the restore root before concatenating it with the destination directory.

An attacker who controls or tampers with a snapshot file can insert entries whose paths contain ../ sequences or absolute path components. When the restore routine processes such an entry, the resulting write target resolves outside the restore directory. The utility functions in duplicacy_utils_others.go responsible for filesystem operations do not perform a canonicalization check against the intended base path.

Root Cause

The root cause is missing input validation on deserialized snapshot metadata. Path components read from snapshot files are trusted as safe filesystem paths without normalization or containment checks. This maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory.

Attack Vector

Exploitation requires the victim to restore from a snapshot the attacker has tampered with or supplied. Delivery scenarios include compromised backup storage endpoints, shared repositories with weak access controls, or supply chain scenarios where snapshot files transit untrusted infrastructure. User interaction is required because the victim must initiate the restore. Once triggered, arbitrary files are written wherever the restoring user has write permissions.

See the VulnCheck Duplicacy Advisory and GitHub Issue #692 for additional technical context.

Detection Methods for CVE-2026-82264

Indicators of Compromise

Files written outside the expected restore directory following a duplicacy restore invocation, particularly under home directories, ~/.ssh/, ~/.bashrc, or system configuration paths
Snapshot entries containing ../, ..\, or absolute path prefixes when inspected with duplicacy list -files
Unexpected modifications to shell startup scripts, cron files, or authorized keys immediately after a restore operation
Backup repositories from untrusted sources or with recent unauthorized modifications to snapshot files

Detection Strategies

Audit snapshot contents before restore by extracting file listings and grepping for traversal sequences or absolute paths
Monitor filesystem activity during restore operations to identify writes outside the declared restore directory
Compare pre- and post-restore file inventories in directories that should not be touched by the operation
Alert on integrity changes to security-sensitive files such as SSH keys, sudoers configuration, and shell rc files

Monitoring Recommendations

Enable process and file telemetry on hosts that perform Duplicacy restores, capturing parent process, target paths, and user context
Log all Duplicacy CLI invocations along with the storage backend and snapshot identifier used
Track write operations by the Duplicacy process to paths outside its working restore directory using EDR file-modification events
Ingest these events into a centralized data lake to correlate restore activity with subsequent anomalous authentication or execution

How to Mitigate CVE-2026-82264

Immediate Actions Required

Avoid restoring from any snapshot whose provenance or integrity cannot be verified until a patched version is available
Perform restores under a dedicated low-privilege account with write access limited to the intended restore directory
Inspect snapshot listings for suspicious path components before initiating restore operations
Restrict write access to snapshot storage backends and enforce authentication on repository endpoints

Patch Information

At the time of publication, no fixed version has been referenced in the NVD entry. Monitor the Duplicacy GitHub project and GitHub Issue #692 for a patched release. Upgrade to a fixed version as soon as one becomes available.

Workarounds

Run duplicacy restore inside a sandbox, container, or chroot with no write access to sensitive filesystem locations
Restore into an empty, isolated staging directory and validate contents before copying files back to production paths
Apply mandatory access controls such as AppArmor or SELinux profiles that constrain Duplicacy's write targets
Verify snapshot integrity through out-of-band checksums or signed manifests supplied by the original backup producer

bash

# Example: run restore as a constrained user into an isolated directory
sudo -u restore-svc mkdir -p /srv/restore/staging
sudo -u restore-svc duplicacy restore -r <revision> -- /srv/restore/staging

# Verify no files were written outside the staging directory
find / -newer /srv/restore/staging -not -path '/srv/restore/*' \
  -not -path '/proc/*' -not -path '/sys/*' 2>/dev/null