An insufficient character filtering flaw in the backup agent signing module of WebPros Comet Backup allows an authenticated tenant administrator to execute arbitrary code on the server with privileged user rights, and subsequently on any connected devices. The vulnerability stems from unsanitized input in the signing process, enabling code injection and full system compromise. The impact is total loss of confidentiality, integrity and availability for the affected server and networks it services.

WebPros Comet Backup software is affected. No specific versions are listed in the advisory, so all deployments that have not applied the vendor’s patch are potentially vulnerable.

The CVSS score of 9.1 indicates a very high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an authenticated tenant administrator; an attacker in that role can exploit the flaw to run code with privileged user privileges, potentially enabling lateral movement to connected devices.