CVE-2026-104805 DigitalCanion Backup - Unrestricted File Upload

DigitalCanion backup restoration functionality contains an unrestricted file upload caused by improper validation of restored TGZ archive files, letting attackers with repository access place arbitrary files, potentially leading to root code execution, exploit requires access to backup repository.

CVSS base score 8.5 /10
High
CISA KEV
Not listed
Public exploit
None known
EPSS
0.22% chance of exploitation in 30 days
View the NVD record ↗

Details

Type
Unrestricted File Upload
Impact
File System Write, Remote Code Execution
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:U/V:D/RE:M/U:Amber
Published
5 October 2026
Updated
15 October 2026
Weakness
CWE-22

Vendor fix

Implement strict validation and file-signature verification for restored archives and enforce backup repository access controls and passwords.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

References

← All CVEs