CVE-2025-24832: Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for…

PriorityP428medium5.5CVSS 3.0

AVLACLPRLUINSUCNIHAN

EPSS

0.19%

8.6th percentile

Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
acronis	acronis_backup_extension_for_plesk	>= unspecified < 1.8.7.615	1.8.7.615
acronis	acronis_backup_plugin_for_cpanel_whm	>= unspecified < 1.8.4.866	1.8.4.866
acronis	acronis_backup_plugin_for_cpanel_whm	>= unspecified < 1.9.1.892	1.9.1.892

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.