Skip to main content

Home Assistant Core CVE-2026-64825

| EUVDEUVD-2026-46301 CRITICAL
Path Traversal (CWE-22)
2026-07-21 VulnCheck GHSA-5hxg-r395-fqxx
Path Traversal Home Assistant Core
9.0
CVSS 4.0 · Vendor: VulnCheck
Share

Severity by source

Vendor (VulnCheck) PRIMARY
9.0 CRITICAL
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
7.5 HIGH

AC:H because exploitation is limited to the transient onboarding window; PR:N/UI:N as it is unauthenticated with no interaction; S:C and I:H for root-level arbitrary write escaping the app to the whole host, C:N as no read primitive.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:L
4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

3
Source Code Evidence Fetched
Jul 21, 2026 - 16:25 vuln.today
Analysis Generated
Jul 21, 2026 - 16:25 vuln.today
CVE Published
Jul 21, 2026 - 15:40 cve.org
CRITICAL 9.0

DescriptionCVE.org

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.__truediv__ to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.

AnalysisAI

Arbitrary file write in Home Assistant Core before 2026.6.0 lets unauthenticated attackers plant attacker-controlled files anywhere on the host by uploading a malicious backup archive during the initial onboarding window. Because the process frequently runs as root (e.g., in the supervised/OS install), this path traversal escalates to full host compromise. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Reach un-onboarded instance during setup
Delivery
Upload crafted backup archive
Exploit
Set absolute path in backup.json 'name'
Execution
pathlib discards backup dir prefix
Persist
Write attacker file to arbitrary host path
Impact
Execute code as root
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that the target Home Assistant Core instance be reachable during the initial onboarding window - the setup phase before an owner account is created - which is the concrete attack requirement encoded as AT:P in the CVSS vector. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment This is a genuine high priority for exposed or freshly-provisioned instances. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker who can reach a Home Assistant Core instance that is still in its initial onboarding state (no owner account yet) uploads a crafted backup archive whose backup.json 'name' field contains an absolute path. The server joins that value onto the backup directory, pathlib discards the prefix, and the attacker's file lands at an arbitrary location - for example dropping a malicious automation, a cron/systemd unit, or overwriting a config file - yielding code execution as root when the process is privileged. …
Remediation Vendor-released patch: upgrade to Home Assistant Core 2026.6.0 or later (release notes: https://github.com/home-assistant/core/releases/tag/2026.6.0; fix commit 567fe858289876b68b8162a77bd46e1e1af79752). … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, immediately upgrade all Home Assistant Core instances to version 2026.6.0 or later, prioritizing supervised and OS installations running with root privileges. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Home Assistant Core

View all
CVE-2026-64824 CRITICAL
9.3 Jul 21

Path-traversal to remote code execution in Home Assistant Core before 2026.6.0 lets an authenticated user who can supply
CVE-2026-64823 LOW
2.1 Jul 21

Cross-site scripting in Home Assistant Core's Shelly integration allows an attacker who controls a Shelly device to exec

Same weakness CWE-22 – Path Traversal

View all
CVE-2019-3396 CRITICAL POC
9.8
CVE-2019-19781 CRITICAL POC
9.8
CVE-2020-5902 CRITICAL POC
9.8
CVE-2021-40444 HIGH POC
8.8
CVE-2021-27065 HIGH POC
7.8
CVE-2019-11510 CRITICAL POC
10.0
CVE-2018-13379 CRITICAL POC
9.1
CVE-2023-47246 CRITICAL POC
9.8

Same technique Path Traversal

View all
CVE-2025-64446 CRITICAL POC
9.8
CVE-2023-47246 CRITICAL POC
9.8
CVE-2015-0016 HIGH POC
7.8
CVE-2016-0752 HIGH POC
7.5
CVE-2024-13159 CRITICAL POC
9.8
CVE-2024-13160 CRITICAL POC
9.8
CVE-2024-13161 CRITICAL POC
9.8
CVE-2014-0780 CRITICAL POC
9.8

Share

CVE-2026-64825 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy