{"id":"CVE-2026-108140","aliases":[],"title":"A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attac","description":"A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a backed-up NAS share, to write attacker-controlled files to an arbitrary path on the backup server through relative path traversal.","severity":"medium","score":5.9,"published":"2026-10-27T16:16:58.797Z","modified":"2026-10-27T16:16:58.797Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://www.veeam.com/kb4948"],"sources":[{"name":"CVE","id":"CVE-2026-108140","modified":"2026-10-27T16:16:58.797Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-108140"}],"assessments":[{"source":"CNA","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N","score":5.9}]}