{"id":"CVE-2026-3339","aliases":["EUVD-2026-13897","GHSA-fxxv-5hv8-hp3c"],"status":"published","title":"Keep Backup Daily \u003c= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter","description":"The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.","severity":{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00398,"percentile":0.34508,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2026-03-20T23:25:09Z","modified":"2026-06-17T10:43:26Z","products":[{"vendor":"fahadmahmood","product":"keep backup daily"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/01984754-e332-4500-99a2-10a7b79967f5?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L855"},{"url":"https://plugins.trac.wordpress.org/browser/keep-backup-daily/trunk/inc/functions.php#L855"},{"url":"https://plugins.trac.wordpress.org/browser/keep-backup-daily/tags/2.1.1/inc/functions.php#L871"},{"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3481587%40keep-backup-daily\u0026new=3481587%40keep-backup-daily\u0026sfp_email=\u0026sfph_mail="},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-3339"},{"url":"https://github.com/advisories/GHSA-fxxv-5hv8-hp3c"}],"sources":{"cve":[{"id":"CVE-2026-3339","title":"Keep Backup Daily \u003c= 2.1.1 - Authenticated (Admin+) Limited Path Traversal via 'kbd_path' Parameter","description":"The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.","status":"published","published":"2026-03-20T23:25:09.949Z","modified":"2026-04-08T16:32:34.13Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T13:48:58.05327Z"}],"euvd":[{"id":"EUVD-2026-13897","description":"The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.","status":"published","published":"2026-03-20T23:25:09Z","modified":"2026-04-08T16:32:34Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T19:25:11.650607Z"}],"ghsa":[{"id":"GHSA-fxxv-5hv8-hp3c","title":"The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all...","description":"The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.","status":"published","published":"2026-03-21T00:31:44Z","modified":"2026-03-21T00:31:53Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:06:44.698439Z"}],"nvd":[{"id":"CVE-2026-3339","description":"The Keep Backup Daily plugin for WordPress is vulnerable to Limited Path Traversal in all versions up to, and including, 2.1.1 via the `kbd_open_upload_dir` AJAX action. This is due to insufficient validation of the `kbd_path` parameter, which is only sanitized with `sanitize_text_field()` - a function that does not strip path traversal sequences. This makes it possible for authenticated attackers, with Administrator-level access and above, to list the contents of arbitrary directories on the server outside of the intended uploads directory.","status":"published","published":"2026-03-21T00:16:27.627Z","modified":"2026-06-17T10:43:26.053Z","cvss":[{"version":"3.1","score":2.7,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:10.126802Z"}]}}