NAKIVO Backup and Replication Absolute Path Traversal (CVE-2024-48248)

Historical catalog analysis: CISA added this entry on March 19, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2024-48248 is an absolute path traversal vulnerability (CWE-36) affecting NAKIVO Backup and Replication. This flaw enables an attacker to read arbitrary files from the underlying system, potentially exposing sensitive configuration data or system credentials.

Exposure and applicability

This vulnerability applies to organizations deploying NAKIVO Backup and Replication. Because backup infrastructure typically requires high-level privileges to access various data stores and system volumes, a path traversal flaw in this context may provide an attacker with significant visibility into the host environment. On March 19, 2025, CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, indicating that it is actively being leveraged in the wild.

Remediation priorities

Our analysis suggests prioritizing remediation based on the following hierarchy:

1. Immediate Patching: Infrastructure owners should apply vendor-supplied mitigations as detailed in NAKIVO’s release notes. Given the KEV status, this is the primary method for reducing exposure.
2. Cloud Service Review: For those utilizing cloud-based deployments of the software, we recommend following BOD 22-01 guidance to ensure that service providers have addressed the vulnerability within their managed environments.
3. Decommissioning: If a vendor mitigation cannot be applied or is unavailable for a specific legacy version in use, the product should be discontinued to eliminate the attack surface.

For U.S. federal agencies, CISA has established a remediation deadline of April 9, 2025.

How to validate remediation

Verification must go beyond confirming a version number. To ensure exposure is actually reduced, vulnerability management teams should:

• Verify Patch Application: Confirm that the specific security update addressing CVE-2024-48248 was successfully deployed and initialized on all affected nodes.
• Configuration Audit: Review system logs for unauthorized attempts to access sensitive files via absolute paths, which can help determine if the vulnerability was targeted prior to patching.
• Authorized Testing: In a staged environment, security teams may attempt to access known non-sensitive files using path traversal techniques to verify that the vendor’s fix effectively blocks arbitrary file reading.

Limits and open questions

It remains unknown whether this vulnerability has been utilized by specific ransomware campaigns. Furthermore, while patching addresses the flaw, it does not account for potential persistence already established if the system was compromised prior to remediation. Residual risk remains if the backup server is exposed to untrusted networks without compensating network-level access controls.

Source and editorial note

CVE-2024-48248: NAKIVO Backup and Replication Absolute Path Traversal Vulnerability · Source date: March 19, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: March 22, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 21, 2026 at 00:17 UTC.

Request a Vulnerability Assessment