{"id":"CVE-2026-108141","kind":"vulnerability","aliases":["CVE-2026-108141"],"related":[],"title":"Backup server: relative path traversal lets a restore operator write arbitrary files","description":"A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.","summary":"An authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share can write attacker-controlled files to an arbitrary path on the backup server through relative path traversal. The sources do not name the affected backup product or versions.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup-server","infrastructure","nas","restore-operator"],"not_affected_if":["no-restore-operator-role-users","trusted-share-contents"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","triaged_at":"2026-10-27T17:34:52+00:00","updated_at":"2026-10-27T17:34:52+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-27T17:34:52Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Backup server: relative path traversal lets a restore operator write arbitrary files","impact":"high","summary":"An authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share can write attacker-controlled files to an arbitrary path on the backup server through relative path traversal. The sources do not name the affected backup product or versions.","category":"infrastructure","nicknames":[],"who_cares":["backup-server","nas","restore-operator"],"confidence":0.4,"needs_auth":"yes","worst_case":"Attacker writes arbitrary files to paths on the backup server","analyst_note":"Identify the affected backup product and fixed version from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-108141 and its CNA advisory.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-restore-operator-role-users","trusted-share-contents"],"who_is_affected":"Teams that run a backup server that restores data from NAS shares and grants the Restore Operator role to users. Exposure requires that the NAS share contents are attacker-influenced, so installations where only trusted administrators manage backed-up shares have lower risk. The sources do not name the product, so the specific affected deployments cannot be confirmed from the text.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000577,"input_tokens":3289,"output_tokens":497,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-108141':15A,18A '-2026':14A,17A 'affect':71B 'allow':78C 'also':36B,88C 'arbitrari':11A,55B,107C 'attack':50B,102C 'attacker-control':49B,101C 'authent':28B,80C 'back':43B,95C 'backed-up':42B,94C 'backup':1A,20B,59B,72B,111C 'backup-serv':19B 'content':39B,91C 'control':37B,51B,89C,103C 'cve':13A,16A 'file':12A,52B,104C 'infrastructur':22B 'let':6A 'name':69B 'nas':23B,45B,97C 'oper':9A,26B,33B,85C 'path':4A,56B,63B,108C,115C 'product':73B 'relat':3A,62B,114C 'restor':8A,25B,32B,84C 'restore-oper':24B 'role':34B,86C 'server':2A,21B,60B,112C 'share':46B,98C 'sourc':66B 'travers':5A,64B,116C 'user':29B,81C 'version':75B 'vulner':77C 'write':10A,48B,100C","nicknames":[],"mitigations":[],"who_affected":"Teams that run a backup server that restores data from NAS shares and grants the Restore Operator role to users. Exposure requires that the NAS share contents are attacker-influenced, so installations where only trusted administrators manage backed-up shares have lower risk. The sources do not name the product, so the specific affected deployments cannot be confirmed from the text.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T17:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"support@hackerone.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-108141","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-108141","severity":null,"published_at":"2026-10-27T17:16:57+00:00","modified_at":"2026-10-27T17:16:57+00:00","first_seen_at":"2026-10-27T17:32:45+00:00","fetched_at":"2026-10-27T17:32:45+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}