VU#847406: Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability
2026-07-22T20:52:13Z•3b079c9a16ab8232df3ff5c6607f9c0ca504cc53430906175b969999a78defc5
IOCTLanalog-wayauthorization-bypasscryptodenial-of-servicedll-hijackdriverduplicatifirmwarehttp2kernel-exploitationlinuxlocal-privilege-escalationmulti-tenantnode-forgepath-traversalpegatronpickle-deserializationplaneprivilege-escalationremote-code-executionsglangsignature-forgerywindowszeroMQ
What happened
This collection summarizes multiple recent vulnerabilities across diverse software: Duplicati 2.3.0.1 allows local arbitrary code execution when installed to non-default paths due to incorrect ACLs (CVE-2026-16157); Analog Way Picturall Quad Compact Mark II firmware contains a maintenance-script path-traversal that permits local privilege escalation to root (CVE-2026-14985); Plane ≤1.3.0 has a multi-tenant authorization bypass in its asset API enabling authenticated users to access or modify other workspaces’ assets (CVE-2026-15342); some HTTP/2 servers are vulnerable to remote denial-of‑servi
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- certcc_vulnotes
- Record identifier
- 3b079c9a16ab8232df3ff5c6607f9c0ca504cc53430906175b969999a78defc5
- Enrichment time
- 2026-07-22T20:52:13Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.