PT-2026-33402 · WordPress · Jetbackup – Backup

Lukasz Sobanski

·

Published

2026-04-17

·

Updated

2026-04-17

·

CVE-2026-4853

CVSS v3.1

4.9

Medium

VectorAV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions JetBackup – Backup, Restore & Migrate versions prior to 3.1.19.9
Description Insufficient input validation on the fileName parameter in the file upload handler allows for path traversal. The plugin uses sanitize text field(), which removes HTML tags but fails to block path traversal sequences such as '../'. The Upload::getFileLocation() function concatenates this unsanitized filename without using basename() or verifying that the resolved path remains within the intended directory. Consequently, when an invalid file is uploaded, the cleanup logic applies dirname() to the traversed path and passes it to Util::rm(), which recursively deletes the resolved directory. Authenticated attackers with administrator-level access can use this to delete critical WordPress directories, such as 'wp-content/plugins', leading to severe site disruption.
Recommendations Update the plugin to a version newer than 3.1.19.8.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-4853

Affected Products

Jetbackup – Backup