Product:
Avamar Server and Avamar Virtual Edition
Summary
Dell Avamar Server and Avamar Virtual Edition, versions prior to 19.10 SP1 with CHF338912, contain an Improper Limitation of a Pathname to a Restricted Directory vulnerability in the Security. A high privileged attacker with remote access could potentially exploit this vulnerability, leading to arbitrary file deletion.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 6.5 | CVE-2026-22762 |
Exploitation
To exploit this vulnerability, an attacker with high privileges and remote access can manipulate file paths to gain unauthorized access to restricted directories. By crafting specific requests, the attacker can traverse the file system and delete arbitrary files, potentially compromising the integrity of the system.
Affected Products
- Avamar Server: A backup and recovery solution that may be vulnerable to path traversal attacks.
- Avamar Virtual Edition: The virtualized version of Avamar Server, also susceptible to the same vulnerability.
Mitigation
To mitigate this vulnerability, users should upgrade to Avamar Server and Avamar Virtual Edition version 19.10 SP1 with CHF338912 or later. Regularly applying security updates and monitoring access controls can help prevent exploitation.