CVE-2024-47263

MediumCVSS 4.1

Published: 03/06/2026(UTC)Updated: 22/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

Synology Hyper Backup before version 4.1.2-4036 has a path traversal vulnerability in the Backup.Repository webapi component. An authenticated administrator can write specific files containing non-sensitive information outside the allowed directory.

Risk Assessment

An attacker with admin privileges can overwrite system or configuration files, potentially compromising system integrity.

Recommendation

Update Synology Hyper Backup to version 4.1.2-4036 or later.

Other vulnerabilities in Synology Hyper Backup

CVE-2024-47273Medium
An improper limitation of a pathname to a restricted directory (Path Traversal) vulnerability in Backup Task functionality in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users to write specific files via unspecified vectors.

Original NVD description (English source)

An improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in Backup.Repository webapi component in Synology Hyper Backup before 4.1.2-4036 allows remote authenticated users with administrator privileges to write specific files containing non-sensitive information via unspecified vectors.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS