Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. The MSI installer registers a LocalSystem service that executes binaries from the installation directory. If installed in a non-default location, the directory lacks proper ACL protections, allowing standard local users to write files such as malicious DLLs. Upon service restart, these DLLs are loaded by the Windows loader with SYSTEM privileges, enabling privilege escalation and arbitrary code execution.

A local attacker with write access to a non-default Duplicati installation directory can execute arbitrary code with NT AUTHORITY\SYSTEM privileges by placing malicious DLLs that the Duplicati service loads. This results in full system compromise under the context of the LocalSystem service.

Install Duplicati only in the default installation directory (C:\Program Files\Duplicati 2\) where proper ACL protections are applied by default. If a non-default installation directory is necessary, manually configure the directory's ACLs to match those of the default directory to prevent unauthorized write access. Additionally, apply all vendor patches and updates addressing this vulnerability when available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.