CVE-2024-48248 is an absolute path traversal vulnerability in NAKIVO Backup and Replication. CISA added it to the Known Exploited Vulnerabilities catalogue on 19 March 2025, which means attackers have used it in real attacks. NAKIVO Backup and Replication contains an absolute path traversal vulnerability that enables an attacker to read arbitrary files.
What Absolute Path Traversal Means in a Backup Appliance
An absolute path traversal flaw lets an attacker escape the intended file path logic and request files anywhere the application can read. In a backup and recovery product, that matters because these systems often store sensitive configuration, credentials, job history, inventory data, and backup metadata.
The danger is not limited to one file read. If an appliance exposes internal files, an attacker can often map the environment, collect secrets, and use that information to move into connected systems. For a broader view of how traversal and related web application weaknesses are used in practice, see Web Application Attacks Guide.
Why This Vulnerability Is Dangerous in Backup Software
Backup platforms are high-value targets because they sit close to the data an organisation is trying to preserve and often hold the keys to restore it. A path traversal issue in this class of product can expose files that help an attacker understand the network, discover backup repositories, or extract material that supports later compromise.
When an appliance protects multiple systems, a single read primitive can become a force multiplier. The attacker may not need immediate code execution if the exposed files reveal session material, service credentials, API keys, or configuration details that unlock other trust relationships. That is why vendors and defenders treat file-disclosure bugs in backup tools as serious exposure events, not just low-level application defects.
How Organisations Check Exposure and Scope the Fix
Exposure review starts with a complete asset inventory, then verifies whether the affected product is deployed, internet-facing, or reachable by untrusted users. For this term, the authoritative places to confirm version and remediation details are the vendor advisory and the CISA KEV catalogue, not secondary summaries.
Teams should also look beyond the product banner and check where it is used, because backup systems are often embedded in operations and left in service longer than expected. CISA added this CVE to KEV on 19 March 2025, so organisations should assume real-world exploitation pressure and prioritise validation, containment, and patch planning accordingly.
Detection, Containment, and Identity Impact After Exploitation
Because the primary abuse is file disclosure, defenders should review application, proxy, and host logs for suspicious path patterns, unexpected file access attempts, and unusual requests against the backup interface. Post-patch review matters too: if an attacker used the flaw before remediation, the question becomes what they may have read, not just whether the vulnerability is now closed.
The identity impact can be material if the exposed files include passwords, tokens, certificates, session material, or service-account configuration. In that case, rotation and credential invalidation are part of the incident response, because a patch alone does not remove stolen secrets from circulation. The same principle is illustrated by Ivanti Connect Secure exploitation 2024, where exploitation exposed credentials and other sensitive material.
Risk and Threat Considerations
Path traversal in a backup product is especially dangerous because the attacker is not just reading arbitrary files, they are often reading files that describe how the recovery environment is trusted and operated. That can turn a simple disclosure bug into a broader compromise path, especially when the appliance has privileged access to backup stores or management networks.
Failure mechanism: The application fails to constrain file resolution to an approved directory, so crafted input reaches sensitive files outside the intended path.
Impact: Attackers can exfiltrate configuration, credentials, session data, or inventory information, then use that material for lateral movement, persistence, or follow-on compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
CIS Controls v8, OWASP ASVS and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Traversal flaws exploit insecure application handling of filesystem paths. |
| CIS-7 — Continuous Vulnerability Management | This KEV-listed CVE requires prioritised identification and remediation. | |
| Recommendation — Harden the backup appliance and restrict file access paths to approved locations. Prioritise discovery, patching, and verification for exposed NAKIVO instances. | ||
| OWASP ASVS | V4 — API and Web Service | Path traversal is a web request handling failure in the exposed service layer. |
| V14 — Data Protection | The flaw can expose sensitive files and secret material stored by the application. | |
| Recommendation — Verify request validation prevents path traversal in exposed web endpoints. Protect sensitive files so disclosure of one path cannot reveal high-value data. | ||
| NIST SP 800-53 Rev 5 | SI-10 — Information Input Validation | Path traversal is prevented by validating and constraining file-related input. |
| Recommendation — Validate file-path input and reject traversal sequences before file access. | ||
Practitioner Guidance
Why practitioners should care: Backup systems sit in a trust-heavy part of the environment, so a file-disclosure flaw there can expose the very data and secrets used to recover the business. Treat confirmed exploitation as a potential precursor to wider identity and infrastructure compromise, not as a narrow application issue.
What to watch for: Look for unexpected file read attempts, unusual access to administrative endpoints, and signs that backup configuration or credential material may have been exposed. When exposure is confirmed, assume the attacker may have learned enough to target adjacent systems, even if the appliance itself now appears stable.
Practitioner takeaway: Remediation should include patching, log review, secret rotation where warranted, and a fresh look at what the backup server can reach.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org