We discovered a relative path traversal flaw in the certificate handling of Dell PowerProtect Data Domain. A remote attacker who has high privileges on the system can exploit the flaw by manipulating certificate paths, potentially causing a denial‑of‑service condition. The vulnerability allows path traversal to override or corrupt certificate files, leading to service interruption.

Vulnerable versions include Dell PowerProtect Data Domain Feature Release 7.7.1.0 through 8.7, LTS2024 releases 7.13.1.0 to 7.13.1.70, LTS2025 releases 8.3.1.0 to 8.3.1.30, and LTS2026 releases 8.6.1.0 to 8.6.1.10. All affected builds process certificates that are susceptible to relative path manipulation.

The CVSS score of 6.5 classifies the flaw as moderate severity. Because the EPSS score is not available, the likelihood of exploitation cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers would need remote high‑privileged access, which is a high threshold, so the real‑world risk depends on the strength of remote authentication controls.