This vulnerability in HBS 3 Hybrid Backup Sync allows an attacker who has local network access to exploit external control over file names or paths, potentially leading to unauthorized reading or modification of files or directories. The issue is classified under CWE-73 and affects version 26.1.x of the software. The vendor has released a fixed version 26.2.0.938 and later to address this issue. The CVSS 4.0 base score is 7.0, indicating high severity with attack vector requiring physical proximity (local network), low attack complexity, and no privileges or user interaction needed.

An attacker on the local network can exploit this vulnerability to read or modify files or directories on the affected system, potentially leading to unauthorized data access or tampering. This could compromise the integrity and confidentiality of backup data managed by HBS 3 Hybrid Backup Sync.

Upgrade HBS 3 Hybrid Backup Sync to version 26.2.0.938 or later, where this vulnerability has been fixed. No additional mitigation steps are indicated by the vendor advisory.