CVE-2026-104805
HighCVSS 8.5Summary
A vulnerability in the backup restoration functionality allows an attacker with access to the configured backup repository to introduce arbitrary files during restoration. The mechanism fails to properly validate paths, file types, integrity, and authenticity of files within a restored TGZ archive.
Risk Assessment
Arbitrary files can be placed on the system, potentially leading to code execution with root privileges and full compromise of the virtual machine. The absence of enforced backup passwords further increases the risk of unauthorized repository access.
Recommendation
Update the software to a version that verifies signatures and integrity of backup archives. Secure the backup repository with strong passwords and restrict access to trusted accounts only.
Other vulnerabilities in DigitalCanion
See all- CVE-2026-104809High
A vulnerability was discovered in DigitalCanion's product where a privileged process loads an attacker-controlled .so file with a predictable module name without verifying its origin or integrity. The malicious module is then executed with the privileges of that process.
- CVE-2026-104806Medium
Path traversal vulnerability in DigitalCanion's management portal, in the Maintenance → System Logs functionality. Allows access to files outside the intended directory, including sensitive system files.
- CVE-2026-104706High
A path traversal vulnerability was discovered in DigitalCanion's product that allows viewing or downloading sensitive system files over the portal https://<ip>:8443 via the Administration -> View Logs menu.
Original NVD description (English source)
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the backup restoration mechanism, which fails to properly validate the paths, file types, integrity, and authenticity of files contained within a restored TGZ archive. The application does not perform file-signature verification before extracting the archive, allowing a specially crafted backup to contain attacker-controlled files. An attacker with access to the backup SFTP or other configured repository can therefore provide a malicious TGZ archive that, when restored by the system, may place arbitrary files on the underlying Linux system. Depending on the location and permissions of the extracted files, this behavior can potentially be leveraged to achieve arbitrary code execution with root privileges and compromise the underlying virtual machine. The absence of enforced backup passwords further reduces the protection provided by the backup mechanism and may facilitate unauthorized access to the repository.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS