PT-2025-9037 · Acronis · Acronis Backup Plugin For Cpanel & Whm+1

Published 2025-02-27 · Updated 2025-03-01 · CVE-2025-24832

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Acronis Backup plugin for cPanel & WHM (Linux) versions 1.8.4.866 and earlier Acronis Backup plugin for cPanel & WHM (Linux) versions 1.9.1.892 and earlier Acronis Backup extension for Plesk (Linux) versions 1.8.7.615 and earlier

Description The issue is related to arbitrary file overwrite during home directory recovery due to improper symbolic link handling.

Recommendations For Acronis Backup plugin for cPanel & WHM (Linux) versions 1.8.4.866 and earlier, update to build 1.8.4.866 or later. For Acronis Backup plugin for cPanel & WHM (Linux) versions 1.9.1.892 and earlier, update to build 1.9.1.892 or later. For Acronis Backup extension for Plesk (Linux) versions 1.8.7.615 and earlier, update to build 1.8.7.615 or later.

Fix

Weakness Enumeration

CWE-61

Related Identifiers

CVE-2025-24832

Affected Products

Acronis Backup Extension For Plesk

Acronis Backup Plugin For Cpanel & Whm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-24832 · Security Note
• https://security-advisory.acronis.com/advisories/SEC-7649 · Vendor Advisory
• https://twitter.com/cybercronai/status/1895753626489930168 · Twitter Post
• https://twitter.com/bluepinksec/status/1895368783742574802 · Twitter Post
• https://t.me/cvedetector/19096 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1895377805312921719 · Twitter Post
• https://twitter.com/CVEnew/status/1895260225499779530 · Twitter Post