Pghoard
Monthly
Arbitrary file write through path traversal in pghoard 2.7.1 and earlier allows an authenticated attacker with write access to the backup object store to place files outside the PostgreSQL data directory when a database administrator runs a restore. The attacker poisons a delta backup manifest with traversal sequences, and pghoard_restore get-basebackup then writes the payload to attacker-chosen host paths, which can lead to code execution or system compromise under the restore account. The issue is rated CVSS 8.4 and requires both the storage-write prerequisite and a legitimate restore action; only versions up to 2.7.1 are affected, 2.7.2 contains the fix, and no public exploit was identified at time of analysis.
Arbitrary file write through path traversal in pghoard 2.7.1 and earlier allows an authenticated attacker with write access to the backup object store to place files outside the PostgreSQL data directory when a database administrator runs a restore. The attacker poisons a delta backup manifest with traversal sequences, and pghoard_restore get-basebackup then writes the payload to attacker-chosen host paths, which can lead to code execution or system compromise under the restore account. The issue is rated CVSS 8.4 and requires both the storage-write prerequisite and a legitimate restore action; only versions up to 2.7.1 are affected, 2.7.2 contains the fix, and no public exploit was identified at time of analysis.