cve/2022/CVE-2022-26500.md

CVE-2022-26500

Description

Improper limitation of path names in Veeam Backup & Replication 9.5U3, 9.5U4,10.x, and 11.x allows remote authenticated users access to internal API functions that allows attackers to upload and execute arbitrary code.

POC

Reference

No PoCs from references.

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/Ostorlab/KEV
• https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
• https://github.com/Y4er/dotnet-deserialization
• https://github.com/fkie-cad/nvd-json-data-feeds
• https://github.com/musil/100DaysOfHomeLab2022
• https://github.com/nomi-sec/PoC-in-GitHub
• https://github.com/sinsinology/CVE-2022-26500