Synology Active Backup for Business Path Traversal Vulnerability Allowing Arbitrary File Deletion

A path traversal vulnerability has been identified in Synology Active Backup for Business versions prior to 2.7.1-13234, 2.7.1-23234, and 2.7.1-3234. This vulnerability allows remote authenticated users with administrator privileges to delete arbitrary files through unspecified vectors. The issue arises from improper limitations on file paths, enabling unauthorized file deletion within agent-related functionality.

Impact

Exploitation of this vulnerability allows for the arbitrary deletion of files on the affected system.

Remediation

Users can upgrade to Active Backup for Business version 2.7.1-13234 or above for DSM 7.1, version 2.7.1-23234 or above for DSM 7.2, or version 2.7.1-3234 or above for DSM 6.2.