Description

Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820 are affected to Authenticated Path Traversal vulnerability in Exchange Online backup module.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-08-11T07:17:28.233Z",
  "pubdate": "2026-08-11T07:17:28.233Z",
  "executiveSummary": "An authenticated path traversal vulnerability has been identified within the Exchange Online backup module of Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus.\nThis security flaw allows an authenticated malicious actor to manipulate input parameters containing directory traversal sequences, enabling unauthorized access to arbitrary files and directories on the underlying host operating system.\nThe vulnerability directly impacts Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820.\nThe risk implications include potential disclosure of sensitive configuration files, application data, or system files depending on the privileges of the application process.\nSuccessful exploitation of this vulnerability requires the attacker to possess valid authentication credentials to the target application and network access to the vulnerable endpoint.\nOrganizations utilizing affected versions face heightened exposure to unauthorized data access and internal reconnaissance if unmitigated.",
  "technicalDetails": "The vulnerability resides within the Exchange Online backup module of Zohocorp ManageEngine M365 Manager Plus and M365 Security Plus versions below 4820.\nThe root cause stems from insufficient input validation and sanitization of user-supplied parameters processed by the backup module, specifically failing to properly neutralize directory traversal sequences such as dot-dot-slash (..\\ or ../).\nTo exploit this vulnerability, an attacker must first authenticate to the application with valid user credentials, satisfying the initial access control requirements.\nThe attacker then crafts a malicious HTTP request directed at the vulnerable Exchange Online backup module endpoint, injecting path traversal sequences into the vulnerable parameter.\nUpon receiving the request, the application fails to validate the boundaries of the targeted file path, resolving the traversal sequences relative to the application root or system root directory.\nThis flawed logic permits the application to read and return the contents of arbitrary files residing outside the intended operational directory, constrained only by the file system permissions of the service account executing the application.\nThe attack flow proceeds as follows: 1) Authentication against the target M365 Manager Plus or M365 Security Plus instance, 2) Crafting an HTTP request containing malicious path traversal payloads targeting the Exchange Online backup functionality, 3) Transmission of the payload over the network to the application server, 4) Improper handling and resolution of the file path by the vulnerable component, and 5) Retrieval of unauthorized file contents in the application response.\nThe vulnerability requires network exposure of the management interface, valid authentication credentials, and targets specific backend file retrieval routines within the Exchange Online backup component."
}