CVE-2024-48248 is an unauthenticated absolute path traversal in NAKIVO Backup & Replication's getImageByPath function: a flawed path-sanitization routine that merely replaces the "/c" prefix with "userdata" lets an attacker supply an absolute path to read any file the backup service account can access, and because NAKIVO stores integration credentials (cloud, hypervisor, domain) in an encrypted database alongside a recoverable key, the file-read primitive can be escalated to plaintext credential theft and, from there, remote code execution across the enterprise the backup software protects.
Vulnerability summary
8.6
High
94.4%
EPSS score (FIRST)
Yes
CISA KEV catalog
2025-03-04
Published
Vulnerability ID: CVE-2024-48248 · Source: NVD
Affected components
| Component | CPE | Version range |
|---|---|---|
| NAKIVO Backup & Replication Director | cpe:2.3:a:nakivo:backup_&_replication_director:*:*:*:*:*:*:*:* | before 11.0.0.88174 |
What this means
CVE-2024-48248 is an improper limitation of a pathname to a restricted directory vulnerability (CWE-36 / absolute path traversal). NVD's description states: "NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials)" (NVD).
NVD has published its own independent Primary CVSS metric, matching the MITRE CNA submission: CVSS v3.1 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N — network-reachable, low complexity, no privileges or user interaction required, scope-changed due to the downstream credential-theft impact (NVD).
Security research firm watchtowr Labs, which disclosed the issue, traced the flaw to the handling of the getImageByPath request: the original code simply replaced the literal substring "/c" with "userdata" in the supplied path before opening and returning the file (String newPath = path.replace("/c", "userdata"); File file = new File(newPath);), which does not prevent an attacker from supplying an absolute path elsewhere on the filesystem. Because NAKIVO stores credentials for every integrated system (AWS keys, SSH passwords, domain credentials) in an encrypted database, and the decryption key for that database is itself readable via this same file-read primitive, an attacker can recover every stored credential in plaintext — turning a single unauthenticated file-read bug into compromise of every system the backup software is configured to protect (watchtowr Labs). NAKIVO's own release notes confirm the fix, listing under its v11.0.0.88174 (4 November 2024) release: "Fixed Arbitrary File Read (CVE-2024-48248) Vulnerability" (NAKIVO Release Notes).
CISA added CVE-2024-48248 to the Known Exploited Vulnerabilities catalog on 2025-03-19, with a required-action due date of 2025-04-09 (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.9436 (99.851th percentile), consistent with a severe, unauthenticated vulnerability in widely-deployed backup infrastructure — a category of software that is a frequent target for ransomware operators seeking both data destruction and lateral-movement credentials (FIRST EPSS).
Because the real-world impact runs through stolen integration credentials rather than a single patchable code path, NAKIVO operators should upgrade to 11.0.0.88174 or later immediately, rotate every credential configured for cloud, hypervisor, and domain integrations, and review logs for unexpected requests to the getImageByPath / /c/router endpoint before assuming an instance is clean.
Evidence
- NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router, which may lead to remote code execution across the enterprise because PhysicalDiscovery stores cleartext credentials. — NVD
- NVD Primary CVSS v3.1 base score is 8.6 (high), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. — NVD
- Root cause is a flawed getImageByPath path-sanitization routine that only replaces "/c" with "userdata", allowing absolute-path file reads; this can be used to recover the encrypted credential database and its key, exposing plaintext credentials for every integrated system. — watchtowr Labs
- NAKIVO's v11.0.0.88174 release (4 November 2024) release notes list "Fixed Arbitrary File Read (CVE-2024-48248) Vulnerability". — NAKIVO Release Notes
- Added to the CISA Known Exploited Vulnerabilities catalog on 2025-03-19, required-action due date 2025-04-09. — CISA KEV
- EPSS score is 0.9436 (99.851th percentile) as of 2026-10-29. — FIRST EPSS
