Arbitrary File Disclosure Through Path Traversal in Cohesity NetBackup Flex OS Management Shell

An authenticated user with access to the NetBackup Flex OS management shell could read arbitrary files from the underlying operating system by supplying a specially crafted path argument to a diagnostic command. Successful exploitation could expose sensitive system configuration and credential material stored on the appliance.

• Cohesity NetBackup Flex OS: Versions prior to 6.4 are affected. The normalized affected range is encoded with version 0 and an upper bound less than 6.4; the product default status is unaffected outside the listed affected range.
• Remediation boundary: Cohesity's advisory directs customers to upgrade to 6.4 or later. The available evidence does not provide a more granular branch-by-branch status for later releases.

The flaw is a relative path traversal in the path argument of a diagnostic command within the NetBackup Flex OS management shell. The attacker controls the path value and supplies a specially crafted path that escapes the command's intended file boundary, allowing reads from the underlying operating system. Exploitation requires an authenticated account with management shell access and is local to that interface. The available evidence does not identify the diagnostic command, the path normalization or validation logic, or the specific operating-system file permissions involved. The normalized record assigns CWE-347, while the vendor advisory characterizes the behavior as relative path traversal leading to file disclosure.

• Reachability: Exploitation is performed through the management shell and is described as local; the record does not describe a remote unauthenticated path.
• Authentication: An authenticated user with shell access is required; the attack characteristics in the record indicate low privileges are sufficient.
• Interaction and complexity: No additional user interaction is required after shell access is obtained; the attack complexity is described as low.
• Exploitation status: The supplied record does not identify a public exploit, while the returned enrichment records exploitation as none and automatable as no. This reflects the available status evidence and does not prove that abuse cannot occur.

Successful exploitation allows an authenticated shell user to read arbitrary files from the underlying operating system through the affected diagnostic command. The direct technical outcome is information disclosure, including possible exposure of system configuration and credential material stored on the appliance. The attacker must already have management shell access; the evidence does not show that this issue independently grants shell access or escalates privileges. The record does not describe file modification or service disruption. If exposed credentials remain valid, possible organisational consequences include follow-on unauthorized access, but that consequence is not established by the available evidence.

Cohesity NetBackup Flex OS appliances may disclose sensitive operating-system files to an authenticated user with management shell access. Exposed data may include configuration information and credential material, which could support follow-on access if the material remains valid and usable elsewhere. The described impact is loss of confidentiality; the record does not describe file modification, privilege escalation, or service interruption. The evidence also does not establish that any credential was actually accessed or reused.

1. Upgrade Cohesity NetBackup Flex OS to 6.4 or later according to Cohesity's remediation guidance. This is the confirmed primary fix.
2. Until the upgrade is completed, restrict management shell access to authorized administrators only. This reduces exposure but does not fully eliminate the risk.
3. Recheck appliance inventory after upgrading to confirm that systems are no longer within the pre-6.4 affected range.
4. If an affected appliance allowed unnecessary shell access, assess whether configuration data or credential material may have been exposed. The available evidence does not identify exact files that should be replaced or rotated, so a specific file list should not be assumed.

1. Inventory appliances running Cohesity NetBackup Flex OS and confirm the installed version. Versions prior to 6.4 require remediation.
2. Enumerate users or groups with management shell access and compare them with the authorized administrator list.
3. Where suitable appliance audit records are available, review authenticated shell sessions and diagnostic command executions involving unexpected path arguments. This is precautionary monitoring, not a confirmed indicator.
4. The available evidence does not provide a specific IOC, command name, file path, or log event. The absence of related log records does not prove that an appliance is safe.