CVE-2026-104805

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description A flaw in the backup restoration functionality allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The issue occurs because the restoration mechanism fails to properly validate paths, file types, integrity, and authenticity of files within a restored TGZ archive (a compressed archive file). Since the application does not perform file-signature verification before extraction, a specially crafted backup can be used to place arbitrary files on the underlying Linux system. Depending on the file location and permissions, this can lead to arbitrary code execution with root privileges and a full compromise of the virtual machine. The lack of enforced backup passwords further increases the risk of unauthorized repository access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.