CVE-2026-108140
Published on October 27, 2026
A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.
Weakness Type
What is a Directory traversal Vulnerability?
The software uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the software does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVE-2026-108140 has been classified to as a Directory traversal vulnerability or weakness.
Affected Versions
Veeam Backup and Replication:- Version 13.0 and below 13.0.3 is affected.
- Version 13.1 and below 13.1.2 is affected.