Description
backup-manager-upload in Backup Manager before 0.6.3 provides the FTP server hostname, username, and password as plaintext command line arguments during FTP uploads, which allows local users to obtain sensitive information by listing the process and its arguments, a different vulnerability than CVE-2007-2766.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | backup-manager | 0.7.6-3 | — |
| Debian 13 | backup-manager | 0.7.6-3 | — |
| Debian 12 | backup-manager | 0.7.6-3 | — |
| Debian 4.0 | backup-manager | 0.7.5-4 | DSA-1518-1 |
| Debian 3.1 | backup-manager | 0.5.7-1sarge2 | DSA-1518-1 |
Advisories 1
- DSA-1518-1 backup-manager - information disclosure Debian Security (DSA / DLA) · Mar 9, 2026
References
- 26657 third-party-advisory
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=439392
- 25503 vdb-entry
- http://www2.backup-manager.org/Release063
- 29377 third-party-advisory
- 1018639 vdb-entry
- DSA-1518 vendor-advisory
- http://bugzilla.backup-manager.org/cgi-bin/show_bug.cgi?id=173
- 37444 vdb-entry