Veeam Backup & Replication contains a flaw that permits an authenticated Cloud Connect tenant to read arbitrary files on the service provider host. The weakness, identified as a file‑system traversal issue, allows a tenant with valid credentials to obtain file contents beyond the tenant’s designated scope, thereby compromising data confidentiality. While the vulnerability does not enable code execution or denial of service, the exposure of sensitive host files can support further attacks such as privilege escalation or data exfiltration.

The affected product is Veeam Backup and Replication, specifically the Cloud Connect component that manages tenant interactions. The flaw impacts any deployment where tenants are authenticated against the service provider host; version information was not supplied in the advisory.

The CVSS score of 8.3 labels this issue as high severity. No EPSS value was published, and the vulnerability is not listed in the CISA KEV catalog, suggesting that widespread exploitation has not yet been observed publicly. The likely attack vector is an authenticated tenant connecting to the Cloud Connect service; a malicious tenant could exploit the path traversal flaw to view files outside their intended access rights. Because the vulnerability requires valid credentials, remediation is most effective by tightening tenant permissions and ensuring that file‑system access is appropriately sandboxed.