Duplicati v2.3.0.1 has a critical vulnerability related to arbitrary code execution. This vulnerability occurs when Duplicati is installed in a directory other than the default C:\Program Files\Duplicati 2. An attacker with local user privileges who can write files to a non-default installation directory can exploit this. The MSI installer for Duplicati registers a LocalSystem service that executes binaries from the installation directory. When installed in the default location, Windows ACLs protect the directory, preventing unauthorized modifications. However, non-default installations lack these protections, allowing users to write malicious files. If a local attacker places a malicious DLL in such a directory, it can be loaded by the Duplicati service upon restart. This allows the attacker to execute arbitrary code with elevated NT AUTHORITY\SYSTEM privileges. To mitigate this, users should install Duplicati in the default directory or manually secure non-default locations with appropriate ACLs. Applying vendor patches and updating to the latest fixed version of Duplicati is also a crucial solution.