Home Assistant Core EUVD-2026-46301

Exploitation requires that the target Home Assistant Core instance be reachable during the initial onboarding window - the setup phase before an owner account is created - which is the concrete attack requirement encoded as AT:P in the CVSS vector. The attacker must upload a backup archive and set an absolute path in the 'name' field of its backup.json to trigger the pathlib prefix-discard behavior. Full host compromise specifically requires the process to be running as root (as in the Home Assistant OS/supervised deployment); a non-root Core/container install limits writes to the service user's reachable files. Limiting factors: an already-onboarded, in-production instance is not exploitable via this path, and the instance must be network-reachable by the attacker during that setup window.

This is a genuine high priority for exposed or freshly-provisioned instances. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N, base 9.0) shows a network-reachable, unauthenticated, no-user-interaction write with high integrity impact to both the vulnerable system (VI:H) and subsequent host system (SI:H), tempered by AT:P - an attack requirement, namely that exploitation is only possible during the unauthenticated onboarding window before an owner account is created. That AT:P condition is the single biggest real-world limiter: an established, already-onboarded instance is not exploitable via this path, so mass, opportunistic exploitation of long-running deployments is unlikely. No EPSS score was provided in the input, so exploitation probability cannot be quantified here. It is not in CISA KEV and no POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The severity ceiling is high (root-level arbitrary write), but the practical exposure is bounded to instances that are internet-reachable during onboarding.

An attacker who can reach a Home Assistant Core instance that is still in its initial onboarding state (no owner account yet) uploads a crafted backup archive whose backup.json 'name' field contains an absolute path. The server joins that value onto the backup directory, pathlib discards the prefix, and the attacker's file lands at an arbitrary location - for example dropping a malicious automation, a cron/systemd unit, or overwriting a config file - yielding code execution as root when the process is privileged. No public POC is referenced, but the mechanism is straightforward given the described backup.json manipulation.