---
id: "CVE-2026-90727"
kind: "vulnerability"
aliases: ["CVE-2026-90727"]
title: "Dell PowerProtect Data Domain: relative path traversal allows information tampering"
severity: "low"
cvss: 3.8
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["backup", "data-domain", "dell", "infrastructure", "powerprotect", "storage"]
not_affected_if: ["no-remote-access", "unaffected-version"]
published_at: "2026-10-27T14:17:04+00:00"
first_seen_at: "2026-10-27T14:32:26+00:00"
updated_at: "2026-10-27T14:33:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90727", "first_seen_at": "2026-10-27T14:32:26+00:00"}]
---

# Dell PowerProtect Data Domain: relative path traversal allows information tampering

Several Dell PowerProtect Data Domain release lines contain a relative path traversal flaw. A high-privileged attacker with remote access could use it to tamper with information on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Data Domain OS version against the affected ranges listed in the advisory (Feature Release 7.7.1.0 through 8.8, LTS2024 7.13.1.0 through 7.13.1.80, LTS2025 8.3.1.0 through 8.3.1.40, LTS2026 8.6.1.0 through 8.6.1.20)
- Confirm the exact installed version with the Data Domain system's version command (unknown exact command from sources)

## Fix

- Move Data Domain to a fixed release from Dell's advisory for your release line (exact fixed versions: unknown from sources)
- Restrict remote administrative access to trusted management networks until patched

## Timeline

- 2026-10-27T14:32:26+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-90727

## From the sources

Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through 7.13.1.80, LTS2025 release versions 8.3.1.0 through 8.3.1.40, LTS2026 release versions 8.6.1.0 through 8.6.1.20, contain a Relative Path Traversal vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to Information tampering.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_