This vulnerability (CVE-2026-32997) involves an absolute path traversal issue in Veeam Backup and Replication version 13 running on Linux. An authenticated user with Backup Administrator privileges can exploit this flaw to write arbitrary files anywhere on the server filesystem. The CVSS 4.0 base score is 8.6, reflecting network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available, and the vulnerability is publicly disclosed as of May 28, 2026.

An attacker with Backup Administrator privileges can write arbitrary files on the Linux server hosting Veeam Backup and Replication. This could lead to unauthorized modification or replacement of critical files, potentially compromising system integrity and availability. The vulnerability affects confidentiality, integrity, and availability with high severity. There are no reports of exploitation in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Backup Administrator role assignments to trusted personnel only and monitor for suspicious activity related to file writes on the server.