CVE-2026-64825

Name of the Vulnerable Software and Affected Versions Home Assistant Core versions prior to 2026.6.0

Description An issue exists that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem. This occurs during the initial onboarding window when a crafted backup archive is uploaded. By manipulating the name field within the backup.json file inside the archive to provide an absolute path, the pathlib.Path. truediv function discards the intended backup directory prefix. This results in attacker-controlled content being written to arbitrary locations, granting full filesystem access if the process is running as root. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

Recommendations Update Home Assistant Core to version 2026.6.0 or later.