The vulnerability allows an attacker who can read and write to the backup storage location to modify backup manifest files. During a restore operation, this manipulation causes the system to write files to any path accessible to the process, essentially a classic path traversal problem (CWE‑22). The attacker can overwrite configuration files, create or replace executable scripts, or otherwise place malicious content, which can then be executed in the production environment. As a result, the vulnerability can provide the attacker with unauthorized access to sensitive data and the capability to run arbitrary commands, effectively escalating privileges and compromising system integrity.

Vitess, the database clustering system for MySQL, is affected in all releases before 23.0.3 and 22.0.4. The issue arises when the user has write permissions to the backup storage location, such as an S3 bucket. The vendor released a patch in version 23.0.3 for the mainline and 22.0.4 for the 22.x branch, addressing the manifest validation and file path handling. Systems using earlier versions with unrestricted backup storage access are at risk.

The CVSS score of 9.3 indicates a critical severity. The EPSS score of less than 1% suggests that exploitation probability is currently low, possibly due to the need for privileged backup storage access. The vulnerability is not listed in the CISA KEV catalog, so no active exploitation reports are known yet. Nevertheless, an attacker who can write to the backup location can inject malicious paths into the manifest which will be processed during restore, resulting in arbitrary file writes. This attack path typically requires a trusted user or compromised backup storage credentials, but once exploited it can lead to remote code execution in the database cluster environment.