Summary：**Urgent Security Issue Discovered in Duplicati Backup Software v2.3.0.1** *Introduction* A newly **Urgent Security Issue Discovered in Duplicati Backup Software v2.3.0.1**
*Introduction* A newly disclosed flaw in Duplicati version 2.3.0.1 puts users at risk of arbitrary code execution when the backup client is installed outside its default folder. Researchers found that the application trusts the installation directory to load certain DLLs without proper validation, allowing a local attacker with write access to plant a malicious library and gain the same privileges as the Duplicati service. Although the vulnerability requires local access, it can be chained with other privilege‑escalation techniques to achieve full system compromise, making it a pressing concern for enterprises that deploy Duplicati on shared workstations or laptops.
*Key Developments* The issue was first reported to the Duplicati project via its public bug‑tracker on October 12, 2024, and assigned CVE‑2024‑XXXX. Proof‑of‑concept code demonstrates that placing a specially crafted `Duplicati.Server.exe.config` or a malicious `Duplicati.Server.exe` in a non‑standard install path triggers the vulnerable code path during startup. The flaw stems from the application’s reliance on the current working directory to locate auxiliary components, a classic DLL‑search‑order weakness. Duplicati maintainers released a temporary mitigation guide advising users to reinstall the software to `C:\Program Files\Duplicati 2\` or to enforce strict NTFS permissions on the installation folder. A patched build (v2.3.0.2) is undergoing internal testing and is expected to be published within the next two weeks.
*Industry Analysis* Security analysts note that the vulnerability fits a broader trend of open‑source backup tools suffering from path‑trust issues, especially when deployed in environments where users can modify program directories—such as BYOD policies or shared developer workstations. While Duplicati’s encryption‑first approach protects data at rest,
