Absolute Path Traversal (CVE‑2024‑48248) in NAKIVO Backup & Replication Exposes Files
What It Is — NAKIVO Backup & Replication contains an absolute‑path traversal flaw that lets an unauthenticated attacker read arbitrary files from the host running the backup service.
Exploitability — The vulnerability is publicly disclosed (CVE‑2024‑48248) and can be triggered without credentials; proof‑of‑concept code is available. CVSS v3.1 base score is 7.5 (High).
Affected Products — NAKIVO Backup & Replication (all supported versions prior to the vendor‑issued fix).
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous vulnerability monitoring and timely patching as evidence of due‑diligence.
- Highlights a gap in file‑system access controls that can undermine data‑confidentiality assurances required by auditors.
- Provides a concrete example of why organizations must map remediation actions to a control objective (e.g., “protect data at rest and enforce least‑privilege file access”) that satisfies multiple frameworks.
Recommended Actions
- Apply the NAKIVO security patch immediately and verify the version.
- Review backup server configurations for unnecessary file‑system exposure; restrict service‑account permissions to the minimum required.
- Update your vulnerability‑management process to capture remediation evidence (patch logs, configuration snapshots) for audit readiness.
Source: CISA KEV – CVE‑2024‑48248