Overview

Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious files, such as DLLs, in that directory. To mitigate this vulnerability, install Duplicati in the default C:\Program Files\ directory or update to the latest fixed version.

Description

Duplicati is a free, open-source backup solution that stores data across cloud and local storage platforms. On Windows, Duplicati is distributed as an MSI installer. By default, the installer deploys the application to C:\Program Files\Duplicati 2\, where the directory inherits the standard protected ACLs provided by Windows.

The following vulnerability affects Duplicati v2.3.0.1:

CVE-2026-16157 During installation, the MSI registers a LocalSystem service that executes binaries from the Duplicati installation directory. When the default installation path under C:\Program Files\ is used, the directory is protected by the appropriate ACLs. However, if Duplicati is installed to a non-default location, the installer does not apply equivalent permissions to the installation directory. As a result, standard local users may have write access to files within the installation directory, allowing an attacker to place malicious files, such as DLLs, that may be loaded by the LocalSystem service, resulting in arbitrary code execution with elevated privileges.

Impact

A local attacker with write access to a non-default Duplicati installation directory can replace or introduce DLLs used by the Duplicati service. Upon service restart, the Windows loader loads the attacker's DLL before any managed code is executed, allowing arbitrary code to run with NT AUTHORITY\SYSTEM privileges.

Solution

Install Duplicati in the default installation directory (C:\Program Files\Duplicati 2\). If a non-default installation directory is required, ensure it is manually configured with ACLs that provide equivalent protections to those applied under the C:\Program Files\ directory. Additionally, install all vendor patches and updates that address this vulnerability. See Vendor Information for details

Acknowledgements

Thank you to Valton Tahiri for discovering and reporting this vulnerability. This document was written by Bob Kemerer.

Vendor Information