NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may…

published 2025-03-04 last yr. modified 2026-09-24 last mo. also EUVD-2024-54120

cvss: 8.6; version 3.1, CNA
cisa kev: Exploited; added 2025-03-19
epss: 94.4%; EPSS 94.4% chance of exploitation in 30 days, percentile 99.8%
public exploits: 0; none known

NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).

Patch / fix

cisa required action Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

fixed in 1

NAKIVO Backup & Replication Director 11.0.0.88174

Is CVE-2024-48248 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Timeline

2025-03-04 Published
2025-03-19 Added to CISA KEV
2025-03-19 CISA SSVC: exploitation active
2025-04-09 CISA patch deadline

Known exploited

Added: last yr. (2025-03-19)
Patch by: 2025-04-09 (last yr.)
Ransomware: Not known
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Vendor, product: NAKIVO, Backup and Replication
CISA name: NAKIVO Backup and Replication Absolute Path Traversal Vulnerability

ATT&CK techniques

How it is exploited and what it leads to, in MITRE ATT&CK terms.

T1190 Exploit Public-Facing Application exploitation
T1005 Data from Local System primary impact
T1003 OS Credential Dumping secondary impact

kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use

CISA SSVC

Exploitation: Active, exploited in the wild
Automatable: yes
Technical impact: total
Assessed: last yr. (2025-03-19)

Exploit prediction

94.36% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

github.com https://github.com/watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
NVD	3.1	8.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Affected products

NAKIVO Backup & Replication Director

Classification

Weakness

CWE-36 Absolute Path Traversal

References

github.com /watchtowrlabs/nakivo-arbitrary-file-read-poc-CVE-2024-48248/?ref=labs.watchtowr.com
exploit, third-party-advisory
labs.watchtowr.com /the-best-security-is-when-we-all-agree-to-keep-everything-secret-except-the-secrets-nakivo-backup-replication
third-party-advisory
helpcenter.nakivo.com /Release-Notes/Content/Release-Notes.htm
product
cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-48248
government-resource, us-government-resource

Sources

CVE List CVE-2024-48248
NVD CVE-2024-48248

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.