CVE-2024-47266 Path traversal in Active Backup for Business

Low 2.7 Published 13 Feb 2025 Updated 13 Feb 2025

Authenticated administrators can read specific non-sensitive files via path traversal in Synology Active Backup for Business.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-47266?

CVE-2024-47266 is a low-severity path traversal vulnerability in Synology Active Backup for Business, published on 13 Feb 2025. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to read specific files containing non-sensitive information via unspecified vectors.

Weakness: CWE-22

Which versions are affected by CVE-2024-47266?

It affects 1 product.

Products include Synology Active Backup for Business Agent.

How do I fix CVE-2024-47266?

No fix has been published for CVE-2024-47266 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2024-47266 being exploited?

There is no known exploitation of CVE-2024-47266 in the wild and no public exploit code.

Sources

Also known as GHSA-p232-9vcm-fcxv.