PT-2026-80731
CVE-2026-32637
·
Published
2026-08-20
·
Updated
2026-09-18
Description by
CVSS 4.0
5.9
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions
Velero versions prior to 1.18.1
Description
An attacker who gains control of the backup object-storage backend can upload a malicious backup tarball. This tarball can contain parent-directory paths that allow files to escape the intended extraction directory during the restore process, enabling the overwriting of sensitive files within the Velero pod filesystem.
Recommendations
Update to version 1.18.1.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾