EUVD-2026-63474
GHSA-8q3c-rjr9-xxrp
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
Attacker needs write access to backup storage (PR:L); operator must actively run vmrestore (UI:R); file writes escape vmrestore boundary to broader host filesystem (S:C, I:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
4DescriptionCVE.org
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.
AnalysisAI
Path traversal in VictoriaMetrics vmrestore (prior to versions 1.122.25, 1.136.12, and 1.146.0) allows an attacker who controls or can modify a remote backup source - S3, GCS, Azure Blob Storage, or equivalent - to plant dot-dot sequences in object names, causing vmrestore to write restored files outside the configured -storageDataPath directory when an operator executes a restore operation. The CVSS Scope Changed metric (S:C) reflects that successful exploitation reaches beyond the vmrestore process boundary to the broader host filesystem, enabling potential overwrite of binaries, configuration, or credentials within the OS permissions of the process. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to have write access to - or the ability to substitute - the specific backup storage source targeted by the vmrestore invocation (an S3 bucket, GCS bucket, Azure Blob container, or other configured remote storage), enabling injection of object names containing ../ path traversal sequences. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 6.8 score is best understood through its individual metrics rather than the aggregate number. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade vmrestore to a patched release matching your deployment branch: v1.122.25 (https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25), v1.136.12 (https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12), or v1.146.0 (https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today