PT-2026-80283 · Go · Github.Com/Vmware-Tanzu/Velero
Publicado
2026-08-20
·
Atualizado
2026-08-20
CVSS v4.0
6.9
Média
| Vetor | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N |
Impact
What kind of vulnerability is it? Who is impacted?
If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following:
- ../../../tmp/escape 1 -> file created at /tmp/escape 1
- ../../../../../../../../tmp/escape 2 -> file created at /tmp/escape 2
- ../../../tmp/cron poc -> would be /etc/cron.d/backdoor in real attack
- ../../../tmp/ssh poc -> would be ~/.ssh/authorized keys
- ../../../tmp/kubeconfig poc -> would be ~/.kube/config
It's possible that extracting files from the tarball during restore can overwrite sensitive files in the Velero pod filesystem.
Patches
Has the problem been patched? What versions should users upgrade to?
By far, there is no patch yet.
We are working on the main branch, then cherry-pick to the release-1.18 for v1.18.1 patch.
Workarounds
Is there a way for users to fix or remediate the vulnerability without upgrading?
There is no workaround, but the good news is that keeping your OSS safe will prevent the vulnerability.
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Github.Com/Vmware-Tanzu/Velero