Duplicacy up to version 3.2.5 fails to validate entry paths deserialized from snapshot files during restore. This allows an attacker to craft malicious snapshot entries containing directory traversal sequences, which the restore process interprets without sanitization, enabling the attacker to write files outside the intended restore directory to arbitrary locations that the restoring user can access.

The vulnerability affects the Duplicacy backup utility created by gilbertchen. Any installation of Duplicacy at or before release 3.2.5 is susceptible to this flaw.

The vulnerability carries a CVSS score of 6.1, indicating moderate risk. While the EPSS score is unavailable and it is not listed in the CISA KEV catalog, the ability to write arbitrary files can lead to configuration tampering or execution of malicious code if the written file is later executed. The attack vector is inferred to require an attacker to supply a malicious snapshot file or otherwise manipulate snapshot contents before restoration, as the description does not mention remote exploitation. Consequently, the risk is moderate but significant for systems that accept untrusted snapshots or lack proper integrity checks.