CVE-2026-104805 in MiVoice Office 400
Summary
by MITRE • 10/05/2026
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration.
The specific flaw exists within the backup restoration mechanism, which fails to properly validate the paths, file types, integrity, and authenticity of files contained within a restored TGZ archive. The application does not perform file-signature verification before extracting the archive, allowing a specially crafted backup to contain attacker-controlled files.
An attacker with access to the backup SFTP or other configured repository can therefore provide a malicious TGZ archive that, when restored by the system, may place arbitrary files on the underlying Linux system. Depending on the location and permissions of the extracted files, this behavior can potentially be leveraged to achieve arbitrary code execution with root privileges and compromise the underlying virtual machine.
The absence of enforced backup passwords further reduces the protection provided by the backup mechanism and may facilitate unauthorized access to the repository.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
DigitalCanion has identified a critical security vulnerability within its backup restoration functionality that stems from insufficient input validation during the extraction process. The core technical flaw lies in the application's failure to properly validate file paths, types, integrity, and authenticity when processing TGZ archives intended for system recovery. Specifically, the software does not implement file-signature verification or path canonicalization checks before extracting contents from the archive. This lack of rigorous validation allows an attacker who has access to the configured backup repository to inject arbitrary files into the restoration stream by crafting a malicious TGZ package that bypasses existing security controls.
The operational impact of this vulnerability is severe, as it enables privilege escalation and potential full system compromise. An adversary with network or physical access to the SFTP server or other designated backup storage can upload a specially crafted archive containing payloads designed for remote code execution. When an administrator or automated process initiates a restoration using this malicious file, the application extracts these files directly onto the underlying Linux operating system without scrutiny. Depending on the specific paths targeted and the permissions associated with those directories, the injected executable may run with elevated privileges, potentially achieving root-level access. This scenario effectively allows the attacker to take control of the virtual machine hosting the DigitalCanion instance, leading to a complete breach of confidentiality, integrity, and availability for all data managed by the platform.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which describes path traversal issues allowing access outside intended directories, and CWE-865: Incorrect Access Control, reflecting the failure to enforce proper authorization checks on file extraction operations. Furthermore, from an offensive security perspective, this flaw facilitates techniques documented in the MITRE ATT&CK framework under Initial Access via Valid Accounts or Supply Chain Compromise, as well as Execution via Remote File Inclusion if specific web-facing components are involved. The absence of enforced backup passwords further exacerbates the risk by removing a layer of authentication that could otherwise restrict repository access to authorized personnel only, thereby widening the attack surface for unauthorized actors seeking to exploit this restoration mechanism.
To mitigate these risks, immediate remediation efforts should focus on implementing strict path validation and canonicalization techniques during archive extraction to prevent directory traversal attacks. Developers must enforce file type verification using magic numbers rather than relying solely on extensions and implement cryptographic signature verification to ensure the authenticity of backup contents before any data is written to disk. Additionally, enforcing strong password policies for backup repositories and restricting access through role-based access control (RBAC) will reduce the likelihood of an attacker gaining initial foothold in the storage system. Regular security audits and penetration testing focused on file handling routines are recommended to identify similar weaknesses across other modules within the application ecosystem.