Vulnerability · Published Feb 13, 2025 · Assigned by synology

CVE-2024-47266

Low 2.7

In plain English

A low-severity path traversal in Active Backup for Business from Synology. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)2.7Low

Exploit odds (30 days)0.5%top 58.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in share file list functionality in Synology Active Backup for Business before 2.7.1-13234, 2.7.1-23234 and 2.7.1-3234 allows remote authenticated users with administrator privileges to read specific files containing non-sensitive information via unspecified vectors.

Affected products (as reported)

Vendor	Product	Versions
Synology	Active Backup for Business	* – before 2.7.1-13234* – before 2.7.1-23234* – before 2.7.1-3234

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N

References

Synology-SA-25:02 Active Backup for Business vendor-advisory