Path Parsing Flaw in Nero BackItUp Affects Security
CVE-2025-63680
Currently unrated
What is CVE-2025-63680?
Nero BackItUp, part of the Nero Productline, is exposed to a path parsing and UI rendering flaw that can lead to arbitrary code execution. This occurs when an attacker crafts a unique entry that exploits the Windows ShellExecuteW fallback extension resolution. By establishing a specially designed folder with a trailing dot and a script sharing the same name, Nero BackItUp visually represents the script as a folder icon. Once this occurs, triggering the ShellExecuteW function can execute the script without user consent, thus compromising system security.