Duplicati v2.3.0.1 has a vulnerability where Authenticated Users receive MODIFY permissions that extend to all subdirectories of the installation path. Installing the software outside the default Program Files directory results in a LocalSystem service running from a directory writable by standard users. This permits a standard local user to replace DLL files in the service directory. When the service restarts, the OS loads the attacker's DLL first, leading to arbitrary code execution as SYSTEM.

An attacker with standard local user access can escalate privileges to SYSTEM by overwriting DLLs in the service directory and triggering a service restart. This can lead to full system compromise due to arbitrary code execution with the highest privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid installing Duplicati outside the Program Files directory or on custom paths that are writable by standard users. Restrict permissions on the service directory to prevent unauthorized modifications. Monitor for updates from the vendor addressing this issue.