An improper limitation of a pathname to a restricted directory ('Path Traversal') enables remote authenticated users to write specific files. This vulnerability could allow an attacker to overwrite configuration or system files, potentially compromising confidentiality, integrity, and availability of the affected Synology Hyper Backup system.

Synology Hyper Backup versions prior to 4.1.2-4036 are affected, including multiple Synology NAS models that run the indicated backup task functionality.

The CVSS score of 4.3 reflects moderate severity. EPSS data is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote authenticated, meaning that the attacker must be able to log in to the device. Once authenticated, the path traversal flaw can be used to write arbitrary files, but no additional privileged escalation is required from the description.