CVE-2024-48248: NAKIVO Backup & Replication absolute path traversal file read

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityIt is in CISA KEV with a near-maximum EPSS score, requires no authentication, and can expose cleartext credentials that enable enterprise-wide compromise.

What it is

NAKIVO Backup & Replication before 11.0.0.88174 exposes the getImageByPath endpoint at /c/router, which fails to restrict file paths and allows absolute path traversal to read arbitrary files. Because PhysicalDiscovery stores cleartext credentials, reading those files can hand an attacker the credentials needed to move laterally and execute code across the enterprise.

Impact

An unauthenticated attacker can read arbitrary files from the appliance, including configuration and credential material. Those cleartext PhysicalDiscovery credentials can be reused to compromise other enterprise systems, potentially leading to remote code execution.

Attack surface

Reached over the network via the /c/router endpoint using getImageByPath; the CVSS vector shows no privileges or user interaction required. Any host that can reach the NAKIVO service can attempt the traversal.

Exploitation

CISA added this to KEV on 2025-03-19 with a 2025-04-09 remediation due date, and EPSS is 0.94356 (99.8th percentile), indicating active exploitation. A public proof-of-concept exploit is referenced by WatchTowr.

What to do

• Upgrade NAKIVO Backup & Replication to 11.0.0.88174 or later immediately.
• If patching is not possible, isolate the NAKIVO appliance from untrusted networks and restrict access to the management interface.
• Rotate any credentials stored or used by PhysicalDiscovery and other NAKIVO components, since cleartext credentials may have been exposed.
• Follow CISA BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable.

Detection

• Monitor HTTP requests to /c/router with getImageByPath parameters containing absolute paths or traversal sequences.
• Alert on unexpected outbound connections or authentication attempts from the NAKIVO appliance using stored credentials.
• Review file access logs on the appliance for reads of configuration or credential files outside expected paths.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.