CVE-2026-108140
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
An authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share can write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
Risk Assessment
This may allow overwriting or placing malicious files anywhere on the backup server, risking privilege escalation or system compromise.
Recommendation
Restrict the Restore Operator role to trusted users, validate restored backup contents, and apply the vendor fix that eliminates the path traversal.
Other vulnerabilities in Veeam Backup & Replication
See all- CVE-2026-21672High
A vulnerability allowing local privilege escalation on Windows-based Veeam Backup & Replication servers.
- CVE-2025-64393Critical
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
- CVE-2026-21671Critical
The vulnerability allows an authenticated user with the Backup Administrator role to perform remote code execution (RCE) in high availability (HA) deployments of Veeam Backup & Replication.
- CVE-2025-48983Critical
A vulnerability in the Mount service of Veeam Backup & Replication allows for remote code execution (RCE) on the Backup infrastructure hosts by an authenticated domain user.
- CVE-2024-40711CriticalActively exploited
A deserialization of untrusted data vulnerability with a malicious payload can allow an unauthenticated remote code execution (RCE).
- CVE-2023-27532HighActively exploited
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This may lead to gaining access to the backup infrastructure hosts.
- CVE-2022-26501CriticalActively exploited
Veeam Backup & Replication 10.x and 11.x has Incorrect Access Control (issue 1 of 2).
- CVE-2022-26500HighActively exploited
Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4, 10.x, and 11.x. A remote authenticated user can access internal API functions and upload and execute arbitrary code.
- CVE-2026-108141Medium
An authenticated user with the Restore Operator role who also controls the contents of a backed-up NAS share can write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
- CVE-2026-93026Medium
This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
Original NVD description (English source)
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS