High · 8.8 CVE-2024-25228 EUVD-2024-22564GHSA-2hx4-gpwf-5qv2

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function …

Published Mar 14, 2024 · Updated Nov 4, 2025 · Assigned by mitre

Description

Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.

References

https://blog.leakix.net/2024/01/vinchin-backup-rce-chain/
20240313 [Full Disclosure] CVE-2024-25228: Unpatched Command Injection in Vinchin Backup & Recovery Versions 7.2 and Earlier mailing-list