---
id: CVE-2026-82264
title: >-
  Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore
  function that fails to validate entry paths deserialized from snapshot files
summary: >-
  Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore
  function that fails to validate entry paths deserialized from snapshot files.
  Attackers can craft malicious snapshot entries with directory traversal
  sequence…
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H'
cwe:
  - CWE-22
published: '2026-08-28'
updated: '2026-09-23'
sourceUpdated: '2026-09-23T17:17:45.960'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82264'
references:
  - url: 'https://github.com/gilbertchen/duplicacy'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_backupmanager.go
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/gilbertchen/duplicacy/blob/54f97522bff9df8be6797873203310ccbf5a5b00/src/duplicacy_utils_others.go
    label: disclosure@vulncheck.com
  - url: 'https://github.com/gilbertchen/duplicacy/issues/692'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/duplicacy-path-traversal-during-restore-via-unsanitized-snapshot-paths
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
epss: 0.0071
epssPercentile: 0.51461
ingestedAt: '2026-09-23T17:28:14.811Z'
vendor: gilbertchen
product: duplicacy
affected:
  - duplicacy <= 3.2.5
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-28T20:27:54.568155Z'
---

## Overview

Duplicacy through 3.2.5 contains a path traversal vulnerability in the restore function that fails to validate entry paths deserialized from snapshot files. Attackers can craft malicious snapshot entries with directory traversal sequences to write files outside the restore directory to arbitrary locations accessible by the restoring user.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.