All vulnerabilities
CVE-2026-108140

Backup and Replication: A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the b

Veeam Backup and Replication
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in13.0.3Also 13.1.2CVE List
Published27 Oct 2026Updated 27 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.

Text from CVE List

Affected versions 2

  • Backup and Replicationaffected: 13.0 before 13.0.3CVE List
  • Backup and Replicationaffected: 13.1 before 13.1.2CVE List

References 1