A vulnerability in the Iperius Backup service allows the creation of temporary files in the job directory with insecure permissions. When an attacker triggers the affected function, the backup service writes a file that can be read or modified by any user with local access. The weakness falls under unsafe file permissions and information exposure, enabling an attacker to potentially view or tamper with backup metadata. The vulnerability does not enable remote exploitation and requires user interaction with the local system.

Enter Software Iperius Backup versions up to and including 8.7.3 are impacted. The flaw resides in the component that processes backup jobs located under C:\ProgramData\IperiusBackup\Jobs\. Users running these versions should be aware that job files may be exposed through temporary file permissions.

The CVSS score is 7.3, indicating a high impact if exploited. The EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, suggesting that public exploitation is currently rare. However, the exploit is publicly documented and requires local access with a moderate to high level of technical skill. Once a local account is compromised, the attacker can read or modify backup files, potentially compromising the confidentiality and integrity of backup data.