CVE-2026-63120

Name of the Vulnerable Software and Affected Versions pghoard versions prior to 2.7.2

Description An incomplete path traversal fix allows an attacker with write access to the backup object storage to perform arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). This occurs when a database administrator performs a restore operation using the pghoard restore get-basebackup command. A maliciously crafted delta backup manifest containing path traversal sequences can be used to write arbitrary payloads to the host system.

Recommendations Update to version 2.7.2.