Home Assistant Core EUVD-2026-46300

Exploitation requires an attacker-supplied backup tar archive to be processed by the Home Assistant Core backup-restore function - specifically a tar entry of type SYMTYPE (symlink) whose linkname is an absolute path outside the extraction directory, immediately followed by a regular-file entry that gets written through that symlink. Root-level host RCE additionally depends on the deployment running Home Assistant as root, as the official Docker image does; a non-root deployment limits writes to that user's permissions. Limiting factors per CVSS 4.0 PR:H/UI:A: the attacker must hold high privileges (authenticated ability to initiate a restore) and a restore action (active user interaction) must occur, so this is not exploitable against a default install by an unauthenticated remote attacker.

The vendor CVSS 4.0 score is 9.3 (Critical) with vector AV:N/AC:L/AT:N/PR:H/UI:A, and the impact metrics are maximal (VC/VI/VA:H and subsequent-system SC/SI/SA:H reflecting root-level host compromise). The two dampening factors are real: PR:H means the attacker must already hold high privileges (the ability to initiate a backup restore, i.e. an authenticated admin), and UI:A means a restore action must be performed - this is not a drive-by unauthenticated exploit. That combination makes it more of a privilege-escalation / persistence and post-auth full-host-takeover primitive than a mass-exploitable internet worm. No EPSS score, KEV listing, or public POC was provided, so exploitation likelihood is presently unquantified; the high CVSS is driven by impact severity, not by demonstrated widespread exploitation. Net: a genuine priority for exposed or multi-user Home Assistant instances where restore is reachable by lower-trust actors, but the PR:H/UI:A gating means default single-admin home deployments face lower realistic risk than the 9.3 alone suggests.

An attacker with admin access to a Home Assistant instance (or who tricks an administrator into restoring a supplied backup) crafts a malicious backup tar containing an absolute-linkname symlink entry plus a follow-up file entry targeting site-packages/sitecustomize.py. When the backup is restored, the payload file is written through the symlink outside the extraction directory as root, and the attacker's Python code executes at the next interpreter startup, yielding full host code execution. No public exploit was identified at time of analysis, though VulnCheck has published a technical advisory.