CISA Issues Guidance on Duplicati v2.3.0.1 Vulnerability CVE-2026-16157

Duplicati v2.3.0.1 can allow arbitrary code execution when the application is installed outside the default C:\Program Files\Duplicati 2\ directory. The issue involves a LocalSystem service that executes binaries from the Duplicati installation directory, enabling execution of attacker-supplied code with elevated privileges under the described conditions.

The vulnerability affects Duplicati v2.3.0.1 and is identified as CVE-2026-16157. During installation, the MSI registers a LocalSystem service that executes binaries from the Duplicati installation directory. When the default installation path under C:\Program Files\ is used, the directory is protected by the appropriate ACLs. If Duplicati is installed to a non-default location, the installer does not apply equivalent permissions to the installation directory, and standard local users may have write access to files within that directory. An attacker can then place malicious files, such as DLLs, in the directory that may be loaded by the LocalSystem service. The described execution path includes a service restart in which the Windows loader loads the attacker’s DLL before any managed code is executed.

A local attacker with write access to a non-default Duplicati installation directory can replace or introduce DLLs used by the Duplicati service. Upon service restart, the Windows loader loads the attacker’s DLL before any managed code is executed, allowing arbitrary code to run with NT AUTHORITY\SYSTEM privileges.

Install Duplicati in the default installation directory (C:\Program Files\Duplicati 2\). If a non-default installation directory is required, manually configure ACLs that provide equivalent protections to those applied under the C:\Program Files\ directory. Install all vendor patches and updates that address this vulnerability. Vendor information is referenced for additional details.

Valton Tahiri is credited for discovering and reporting the vulnerability, and the document states it was written by Bob Kemerer.