THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-8q3c-rjr9-xxrp (medium) — VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

[GHSA] GHSA-8q3c-rjr9-xxrp (medium) — VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

medgithub_advisoriesPublished 2026-09-03

GHSA-8q3c-rjr9-xxrp Severity: medium CVE: CVE-2026-61625

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

### Summary The VictoriaMetrics `vmrestore` utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing `..` pa

Indicators of compromise

CVE-2026-61625cve

Original source: https://github.com/advisories/GHSA-8q3c-rjr9-xxrp