CVE-2024-47265

Published: Feb 13, 2025Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.8 / Impact: 3.6

Source: security@synology.com (Secondary)

Description

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in encrypted share umount functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users to write specific files via unspecified vectors.

Affected (3)

Products: Synology: Active Backup For Business Agent

Synology

1 product

Active Backup For Business Agent

Configuration A

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Active Backup For Business Agent	Before 2.7.1-13234

Running on/with	Platform Versions
Synology Diskstation Manager	Version 7.1

Configuration B

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Active Backup For Business Agent	Before 2.7.1-3234

Running on/with	Platform Versions
Synology Diskstation Manager	Version 6.2

Configuration C

1 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Synology Active Backup For Business Agent	Before 2.7.1-23234

Running on/with	Platform Versions
Synology Diskstation Manager	Version 7.2

Related CWEs

CWE-73

External Control of File Name or Path

The product allows user input to control or influence paths or file names that are used in filesystem operations.

References (1)

https://www.synology.com/en-global/security/advisory/Synology_SA_25_02

Source: security@synology.com

Vendor Advisory

Timeline

No history available yet.