CVE-2025-24832
Medium
Description
Arbitrary file overwrite during home directory recovery due to improper symbolic link handling. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 1.8.4.866, Acronis Backup plugin for cPanel & WHM (Linux) before build 1.9.1.892, Acronis Backup extension for Plesk (Linux) before build 1.8.7.615.
SeverityMedium
CVSS5.5
Exploit probability—
ProductAcronis Backup plugin for cPanel & WHM
PublishedFeb 27, 2025
First seenFeb 27, 2025
Weakness typeCWE-61CWE-61
How to fix
Update
- Acronis Acronis Backup plugin for cPanel & WHM1.8.4.866, 1.9.1.892 or later
- Acronis Acronis Backup extension for Plesk1.8.7.615 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Acronis Acronis Backup plugin for cPanel & WHM | v < 1.8.4.866, v < 1.9.1.892 | 1.8.4.866, 1.9.1.892 |
| Acronis Acronis Backup extension for Plesk | v < 1.8.7.615 | 1.8.7.615 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.