Threats tagged 'ghsa-qhf9-chp9-gc7j'

Nero BackItUp in the Nero product line has a path parsing and UI rendering vulnerability (CWE-22) that can lead to arbitrary code execution. This occurs when a user clicks a crafted entry involving a trailing-dot folder and a script with the same basename. The product renders the script as a folder icon and then executes it via Windows ShellExecuteW fallback extension resolution. The flaw affects versions from 2019 through 2025 and earlier. The vendor has acknowledged the issue but no patch information is provided.