EUVD-2026-46300
GHSA-cwh8-w64c-4j5h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Restore requires authenticated admin (PR:H) and a restore action (UI:R); root-level write outside the app boundary is a scope change (S:C) yielding full C/I/A impact.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
3DescriptionCVE.org
Home Assistant Core before 2026.6.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assistant process as root and the subsequent regular-file entry is written through the unvalidated symlink, attackers can achieve remote code execution by overwriting auto-imported Python paths such as site-packages/sitecustomize.py or custom component directories.
Articles & Coverage 2
AnalysisAI
Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply a backup archive overwrite arbitrary files on the host. The backup-restore routine trusts a tar SYMTYPE (symlink) entry whose linkname is an absolute path outside the extraction directory, then writes a following regular-file entry through that unvalidated symlink; because the official Docker image runs the process as root, an attacker can drop code into auto-imported Python paths (e.g. site-packages/sitecustomize.py) and gain code execution. Reported by VulnCheck with a vendor patch available (2026.6.0); no public exploit identified at time of analysis and it is not listed in CISA KEV.
Technical ContextAI
The flaw is a classic CWE-22 path traversal, but realized through symlink abuse in tar extraction rather than simple '../' segments. A malicious backup tar contains two crafted entries: a SYMTYPE (symbolic link) member with a benign-looking name but an absolute linkname pointing outside the intended restore directory, followed by a regular-file member written through that symlink. Home Assistant Core is a Python application (per CPE cpe:2.3:a:home-assistant:home_assistant_core:*) whose official container image runs as root, so file writes are unconstrained by the host filesystem permissions. By targeting auto-imported Python locations such as site-packages/sitecustomize.py (imported automatically at interpreter startup) or custom_components directories, the attacker converts an arbitrary-write primitive into arbitrary code execution the next time the interpreter or integration loads.
RemediationAI
Vendor-released patch: upgrade to Home Assistant Core 2026.6.0 or later, which corrects the backup-restore symlink handling (fix commit 1e457600f1093c15e1325742d03e2b76498c79c1, PR 172252). Until upgrading, restrict who can trigger a backup restore and never restore backup archives from untrusted or unverified sources, since a crafted archive is the delivery vector. As a hardening compensating control, avoid running the container as root - run Home Assistant under a non-root user or with a read-only root filesystem and dropped capabilities so that a traversal write cannot reach site-packages or system paths (trade-off: some add-ons/integrations may expect root and require adjustment). Refer to the release notes (https://github.com/home-assistant/core/releases/tag/2026.6.0) and the VulnCheck advisory (https://www.vulncheck.com/advisories/home-assistant-core-symlink-path-traversal-rce-via-backup-restore) for details.
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
Unauthenticated remote code execution affects Kestra OSS (the open-source event-driven orchestration platform) prior to
Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
Same weakness CWE-22 – Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today