Description

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-28T20:20:16.923Z",
  "pubdate": "2026-08-28T20:20:16.923Z",
  "executiveSummary": "Duplicacy versions through 3.2.5 are susceptible to a critical path traversal vulnerability within the restore function. This flaw arises from the inadequate validation of file paths deserialized from snapshot files during the restoration process.\nBy manipulating snapshot entry paths to include directory traversal sequences, an unauthenticated or malicious actor can cause the application to write files to arbitrary locations on the host filesystem that are reachable under the security context of the user executing the restoration command.\nThe vulnerability presents a significant risk as it allows for arbitrary file write or overwrite operations. An attacker could potentially replace critical system binaries, configuration files, or sensitive data, leading to full system compromise, escalation of privilege, or persistent backend code execution.\nExploitation is contingent upon the user performing a restoration from a malicious or compromised snapshot file. The impact is bounded by the filesystem permissions assigned to the user executing the Duplicacy restore process, which typically includes the ability to modify or overwrite existing files within the scope of the user's write access.",
  "technicalDetails": "The root cause of this vulnerability lies in an improper implementation of input validation during the deserialization of snapshot metadata in the restore function. Duplicacy snapshot files contain serialized lists of file paths and metadata intended for restoration. The application fails to sanitize or validate these path strings before passing them to the filesystem interface for file creation.\nThe vulnerability is triggered during the restoration process, where the application iterates through the contents of a snapshot. When the application encounters a file entry path containing directory traversal sequences, such as '../', it does not properly constrain the resulting file operation to the intended restore directory. Consequently, the filesystem driver resolves these sequences against the base directory, causing the file pointer to escape the designated destination path.\nThe attack flow follows a sequential pattern: 1) An attacker creates or modifies a snapshot file to include a malicious entry path using traversal characters (e.g., '../../etc/cron.d/malicious_job'). 2) The attacker distributes this malicious snapshot to a target user. 3) The target user initiates the Duplicacy restore command on the compromised snapshot. 4) The restore function parses the malformed path string without sufficient normalization or validation. 5) The application executes a file creation system call using the resolved, out-of-bounds path. 6) The file content dictated by the snapshot entry is written to the arbitrary location on the filesystem.\nBecause the restoration process operates under the identity of the user running the Duplicacy client, the exploit inherits all filesystem permissions of that user. If the user running the restore command has administrative or root privileges, the impact of the arbitrary write is elevated significantly. The payload behavior is limited to the constraints of the user's write access; however, in many deployments, this is sufficient to overwrite application configuration files, shared libraries, or binary dependencies, facilitating lateral movement or persistence through arbitrary code execution. The vulnerability is present in the core restoration logic of Duplicacy versions 3.2.5 and earlier, and there are no requirements for network exposure as the attack is triggered locally by the restoration command."
}