File System Permissions Vulnerability in MSP360 Backup by MSP360
CVE-2025-43595

8.5HIGH

Key Information:

Vendor

Msp360

Status
Backup
Vendor
CVE Published:
1 May 2025

What is CVE-2025-43595?

An insecure file system permissions vulnerability in MSP360 Backup version 4.3.1.115 allows low-privileged users to potentially execute commands with root privileges within the 'Online Backup' folder. This can lead to unauthorized access and manipulation of sensitive data. Users are urged to upgrade to MSP360 Backup version 4.4, released on April 22, 2025, to mitigate this risk.

Affected Version(s)

Backup 4.3.1.115

Backup 4.4

References

https://help.msp360.com/cloudberry-backup-mac-linux/whats...
https://raw.githubusercontent.com/cisagov/CSAF/develop/cs...
https://www.cve.org/CVERecord?id=CVE-2025-43595

CVSS V4

Score:
8.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Matthew Galligan, undefined
JSON
.
CVE-2025-43595 : File System Permissions Vulnerability in MSP360 Backup by MSP360