CVE-2011-5081: Cross-site scripting (XSS) vulnerability in RestoreFile.pm in BackupPC 3.1.0, 3.2.1, and possibly other ear...

Security readout for executives and security teams

BackupPC's restore web page could let an attacker place script or HTML into a page viewed by a user. For a backup administration tool, this matters because successful XSS could target administrator sessions or trust decisions. The bundle gives no CVSS score, no active exploitation evidence, and no confirmed fix details. Exposure is most likely where BackupPC's CGI web interface is reachable by untrusted users or lower-privileged authenticated users. Internet-exposed or broadly accessible backup consoles carry higher business risk because backups often contain sensitive operational data. Treat this as a moderate-priority legacy web application risk. It is not known exploited from the provided evidence, but backup administration interfaces are sensitive and should not be broadly reachable. Prioritize inventory, access restriction, and vendor guidance review. Mitigation focus: Identify BackupPC installations and versions, especially 3.1.0 and 3.2.1.; Check BackupPC project or vendor guidance for fixed versions or supported upgrade paths.; Restrict BackupPC web interface access to trusted networks or VPN users..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.