Free Backup Tool 'Duplicati' Has an Admin-Takeover Flaw (CVE-2026-16157) — Only a Risk for Non-Default Install Folders

The Windows edition of Duplicati, a popular free tool for automatically backing up a PC's data, has a weakness that could let someone seize the computer's most powerful account (administrator-level, SYSTEM). It was published on July 23, 2026 in Japan's public vulnerability database JVN (JVNVU#98636554) and assigned the tracking ID "CVE-2026-16157."

Here is the reassuring part first. This weakness only becomes dangerous if you installed Duplicati in a folder other than the default location. If it sits in the standard place that most people accept (C:\Program Files\Duplicati 2\), you are barely affected. On top of that, exploitation requires someone to already operate that PC directly — it is not the kind of flaw that lets anyone hijack your machine over the internet. Let us calmly check the conditions and the fix.

What actually happened with the free backup tool "Duplicati"

Duplicati is a free backup tool that encrypts data such as photos and documents and saves it automatically to the cloud or an external drive. It is widely used, from home PCs to small offices.

The problem is that when Duplicati is installed into a non-standard folder on Windows, the access permissions on that folder (the settings for who may read and write) are not applied properly. Windows' standard location is protected from the start so that ordinary users cannot write to it freely. But if you pick a different location yourself, that protection does not kick in, and even a low-privileged ordinary user can write files into the folder.

The tricky part is that Duplicati's installer (MSI format) registers the program in that folder as a service that runs automatically under "SYSTEM," the most powerful account on Windows. If an attacker places a malicious program component (a DLL file) in the folder, it gets loaded when the service runs and executes with SYSTEM privileges. The discovery and reporting are documented in CERT/CC's vulnerability note (VU#847406): Valton Tahiri discovered it, and Bob Kemerer handled the documentation.

Overview of the flaw (CVE-2026-16157)

Here are the key points at a glance.

This is not a flaw that is struck directly over the internet. It is the type (local privilege escalation) that "promotes" someone who can already use the PC as an ordinary user up to stronger rights. CERT/CC does not provide a severity number (CVSS), but once the conditions line up the PC can be fully taken over, so if you fall under the conditions, acting early is the safe choice.

Who would target this, and why

The person who would exploit this is someone who can already use the PC as an ordinary user. Think of an insider holding a restricted company account, or an attacker who slipped into the machine by some other means but does not yet hold administrator rights. It is not something that lets an outsider hijack someone's PC out of nowhere.

When that person finds a Duplicati folder sitting in a non-standard location, they drop a doctored program component there and wait for the service to run, gaining the PC's highest privileges. Once SYSTEM rights are seized, almost anything on the machine is possible: rewriting settings, shutting down monitoring software, reading other users' data, planting additional malware — the damage spreads fast.

Backup software is an ally for protecting data, but a resident service running with strong privileges is, flipped around, an ideal "escalation route" for attackers. The same shape shows up in other backup products — for example, 'Quest NetVault' had flaws such as authentication bypass. In the sense that self-hosted server software was targeted, it also echoes the case of the media server 'Jellyfin'.

Why the "install location" changes the risk

The hardest part to grasp here is that "the same software becomes more or less dangerous depending on where you installed it." The reason lies in how Windows permissions work.

Windows' standard program location, C:\Program Files\, is protected from the start with strict access permissions so that ordinary users cannot rewrite its contents. Put Duplicati there, and there is almost no room for a malicious component to be slipped in later.

But if a user picks a non-standard location — the root of the C drive, or a homemade folder near the desktop — that folder may keep its loose settings that let ordinary users write to it. Duplicati's installer does not re-protect this loose folder, so anyone who can write there can drop a malicious component. Then a service running with the highest privileges comes along to load a program from it — that combination creates a hole that lets someone leap over the privilege boundary.

What it looks like from a technical angle

Technically, this is a problem where "DLL planting (DLL hijacking)" overlaps with an "insecure service execution path." A DLL is a component file that a program loads when it runs. If a Windows service is designed to load DLLs or executables from a folder with loose write permissions, a user who can write to that folder can swap the contents and run code with the service's privileges — here, SYSTEM.

In Duplicati's case, the MSI installer registers a service that runs as LocalSystem (equivalent to SYSTEM), and when its execution path is non-standard it falls outside the access-permission protections. It is classified as "incorrect permission assignment," and CERT/CC lists the countermeasures as installing into the default folder or manually setting equivalent access permissions (ACLs). As of the CERT/CC vulnerability note publication, the vendor's official position and patch status were listed as "unknown."

Note that this kind of weakness is typically used not as the "starting point" of an attack but as "privilege expansion after intrusion." An attacker first gains a foothold on the PC by other means, then uses a hole like this to climb to administrator-level rights. That is exactly why, even though it looks unremarkable on its own, it magnifies the damage when combined with other attacks. The latest information is also available on the official CVE record.

Is your Duplicati affected?

The dividing line is a single point: "whether the install location is the default." Check in this order.

• You did not change the location during install and just proceeded → it should be in C:\Program Files\Duplicati 2\, so you are most likely not affected.
• You remember choosing a location yourself — "root of the C drive," "inside a user folder," "a homemade folder on the D drive" → you may be affected. Check this as a priority.
• You do not use the Windows edition at all (Linux, Docker, etc.) → this issue stems from the Windows installer's behavior, so it does not apply.

You can confirm the install location by finding Duplicati under Windows "Settings" → "Apps," or by checking the path of the Duplicati service's executable in the service management screen. The version listed as affected is v2.3.0.1, but if the location is non-standard, it is safer to review the settings regardless of version.

What to do right now

The response is simple. Consider the following from the top.

• Reinstall to the default folder. Uninstall once, then reinstall into C:\Program Files\Duplicati 2\ without changing the location — this is the most reliable fix.
• If you cannot change the location, tighten the folder's permissions. Manually set access permissions (ACLs) equivalent to the standard location so that ordinary users cannot write to it.
• Wait for and apply the vendor's fix. Because the official patch status was unknown at publication, watch Duplicati's official release information and apply a fixed version promptly once one ships.
• Raise the priority on shared machines. The more ordinary-user accounts a device has, the more this weakness comes alive, so address those first.

If you use one PC alone and installed it in the default location, there is no need to rush. Just confirming the install location is enough.

Handle it calmly and there is nothing to fear

To recap: CVE-2026-16157 is a local privilege escalation that requires two preconditions to work — "installed in a non-default location" and "able to operate that PC." It is not something that lets anyone hijack any PC over the internet, and there are no reports of exploitation so far. If you installed it in the default place and use it alone, there is no need to panic.

On the other hand, if the device is shared by several people, or you installed it elsewhere for some reason, it is wise not to leave it. Software that resides with strong privileges can be a foothold for attackers to climb up. First, confirm where your Duplicati is installed, and if it is non-standard, reinstall it or tighten the permissions — that alone closes this hole. Precisely because it is a free backup tool you rely on, take a moment to revisit the basics of where it lives.

Frequently asked questions

Q. Am I safe if I installed it in the default location?

A. Yes. The default C:\Program Files\Duplicati 2\ is protected so ordinary users cannot write to it, so the premise of this weakness does not hold. Just confirming the install location is enough for peace of mind.

Q. Can this flaw be used to steal my backed-up data?

A. This is not a flaw that pulls data out directly; it is a "privilege escalation" where an ordinary user seizes the PC's most powerful rights. That said, once the top privileges are taken, almost everything on the PC is within reach, so data ends up at risk too.

Q. I use it on Linux or Docker. Am I affected?

A. This issue stems from how the Windows MSI installer registers a service. It applies to cases installed via the Windows MSI into a non-default location; Linux or Docker deployments do not apply.

Q. Are there any reports of it already being attacked?

A. As of the July 2026 disclosure, there are no confirmed reports of this flaw being exploited. Still, the damage can be large on devices where the conditions line up, so if you fall under them, acting early is the safe choice.

Sources

• ▸ JVNVU#98636554 - Incorrect permission assignment in the backup software "Duplicati" (July 23, 2026)
• ▸ CERT/CC Vulnerability Note VU#847406 - Duplicati incorrect permission assignment (July 22, 2026)
• ▸ Official CVE record - CVE-2026-16157
• ▸ Duplicati official site
• ▸ Duplicati - GitHub releases