CVE-2026-64824

Name of the Vulnerable Software and Affected Versions Home Assistant Core versions prior to 2026.7.0

Description A path traversal issue exists in the backup-restore function. An attacker can write files to arbitrary absolute filesystem paths by providing a specially crafted tar archive. This is achieved using a SYMTYPE entry that pairs a benign member name with an absolute linkname pointing outside the extraction directory. Since the official Docker image executes the Home Assistant process as root, the subsequent regular-file entry is written through the unvalidated symlink. This can lead to remote code execution by overwriting auto-imported Python paths, such as site-packages/sitecustomize.py, or custom component directories.

Recommendations Update Home Assistant Core to version 2026.7.0 or later.