CVE-2026-82264: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in gilbertchen duplicacy

CVE-2026-82264 is a path traversal vulnerability in gilbertchen duplicacy through version 3.2.5. The restore function does not properly validate paths extracted from snapshot files, allowing an attacker to craft malicious snapshot entries containing directory traversal sequences. This can lead to arbitrary file writes outside the designated restore directory, potentially overwriting or creating files in locations accessible by the user performing the restore operation.

An attacker who can supply a malicious snapshot file can cause files to be written outside the intended restore directory, potentially overwriting critical files or placing malicious files in arbitrary locations accessible by the restoring user. This could lead to data corruption or privilege escalation scenarios depending on the environment and user privileges.

No patch or official fix is currently documented. Users should avoid restoring from untrusted snapshot files until a fix is available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.