Backup & Replication Director vulnerabilities

2 known vulnerabilities in Backup & Replication Director from NAKIVO. 2 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.6 High severity

  Backup & Replication Director: Improper Restriction of XML External Entity Reference

  CVE-2025-32406Apr 8, 2025NAKIVO

  An XXE issue in the Director NBR component in NAKIVO Backup & Replication 10.3.x through 11.0.1 before 11.0.2 allows remote attackers fetch and parse the XML response.

• 8.6 High severity

  NAKIVO Backup and Replication Absolute Path Traversal Exploited

  CVE-2024-48248Mar 4, 2025NAKIVOEPSS 94.4%

  NAKIVO Backup & Replication before 11.0.0.88174 allows absolute path traversal for reading files via getImageByPath to /c/router (this may lead to remote code execution across the enterprise because PhysicalDiscovery has cleartext credentials).