CVE-2026-62268

Name of the Vulnerable Software and Affected Versions borg versions prior to 1.4.5 borg 2.0.0 betas prior to b22

Description A flaw exists where extracting a maliciously crafted archive can lead to the deletion or overwriting of files outside the intended extraction directory. This occurs because the software follows symlinks or resolves path traversal sequences like .. within the archive. Additionally, a crafted archive could contain a slave hardlink pointing to a location outside the extraction directory, allowing the software to create a hard-link between an external and internal item.

Recommendations Update to version 1.4.5 or later. Update to version 2.0.0b22 or later. Do not share repository access, borg keys, or passphrases with potential attackers.