{"id":"CVE-2026-61625","summary":"VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root","details":"VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.","aliases":["GHSA-8q3c-rjr9-xxrp","GO-2026-6366"],"modified":"2026-09-20T11:47:12.722262389Z","published":"2026-08-20T16:45:43.024Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-22"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61625.json"},"references":[{"type":"WEB","url":"https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25"},{"type":"WEB","url":"https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12"},{"type":"WEB","url":"https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61625.json"},{"type":"ADVISORY","url":"https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-8q3c-rjr9-xxrp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61625"},{"type":"FIX","url":"https://github.com/VictoriaMetrics/VictoriaMetrics/commit/710c920d6083327042a309e449fae4383617d817"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/victoriametrics/victoriametrics","events":[{"introduced":"bf50dcecfbdf57ab5bd3f470894abf575b3d2f56"},{"introduced":"9287ab8ff89939985576adea4c422a7f4061acac"},{"introduced":"0"},{"fixed":"e8cfb1e17236a7df5770fce768e29e48f1ccf49a"},{"fixed":"80d1104fcad3635ee62bd8d8f2024215b0771a16"},{"fixed":"80d1104fcad3635ee62bd8d8f2024215b0771a16"},{"fixed":"710c920d6083327042a309e449fae4383617d817"}],"database_specific":{"extracted_events":[{"introduced":"1.137.0"},{"fixed":"1.146.0"},{"introduced":"1.123.0"},{"fixed":"1.136.12"},{"introduced":"0"},{"fixed":"1.122.25"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v1.146.0","v1.145.0","v1.136.11","v1.122.24","v1.145.0-cluster","v1.144.0","v1.136.10","v1.122.23","v1.144.0-cluster","v1.143.0-cluster","v1.143.0","v1.136.9","v1.122.22","v1.136.8","v1.142.0","v1.136.7","v1.142.0-cluster","v1.141.0","v1.136.6","v1.122.21","v1.141.0-cluster","v1.136.5","v1.122.20","v1.140.0","v1.136.4","v1.122.19","v1.140.0-cluster","v1.139.0","v1.136.3","v1.122.18","v1.139.0-cluster","v1.138.0","v1.136.2","v1.122.17","v1.138.0-cluster","v1.136.1","v1.137.0","v1.122.16","v1.110.31","v1.137.0-cluster","v1.136.18","v1.136.17","v1.136.16","v1.136.0","v1.122.15","v1.110.30","v1.122.14","v1.110.29","v1.135.0","v1.122.13","v1.110.28","v1.134.0","v1.133.0","v1.122.12","v1.110.27","v1.132.0","v1.122.11","v1.110.26","v1.131.0","v1.122.10","v1.110.25","v1.130.0","v1.122.9","v1.110.24","v1.122.8","v1.110.23","v1.129.1","v1.128.0","v1.122.6","v1.110.21","v1.129.0","v1.122.7","v1.110.22","v1.122.5","v1.110.20","v1.127.0","v1.126.0","v1.110.19","v1.122.4","v1.110.18","v1.125.1","v1.125.0","v1.122.3","v1.110.17","v1.124.0","v1.122.2","v1.110.16","v1.123.0","v1.122.1","v1.110.15","v1.122.0","v1.110.14","v1.102.26","v1.121.0","v1.110.13","v1.102.25","v1.110.12","v1.102.24","v1.120.0","v1.24.0-victorialogs","v1.110.11","v1.119.0","v1.110.10","v1.102.23","v1.23.3-victorialogs","v1.23.2-victorialogs","v1.23.1-victorialogs","v1.23.0-victorialogs","v1.118.0","v1.110.9","v1.102.22","v1.110.8","v1.102.21","v1.117.1","v1.117.0","v1.110.7","v1.102.20","v1.22.2-victorialogs","v1.22.1-victorialogs","v1.22.0-victorialogs","v1.110.6","v1.102.19","v1.21.0-victorialogs","v1.20.0-victorialogs","v1.19.0-victorialogs","v1.18.0-victorialogs","v1.115.0","v1.110.5","v1.102.18","v1.114.0","v1.110.4","v1.102.17","v1.17.0-victorialogs","v1.113.0","v1.110.3","v1.102.16","v1.16.0-victorialogs","v1.102.15","v1.15.0-victorialogs","v1.14.0-victorialogs","v1.110.2","v1.102.14","v1.13.0-victorialogs","v1.12.0-victorialogs","v1.11.0-victorialogs","v1.10.1-victorialogs","v1.10.0-victorialogs","v1.103.0","v1.111.0","v1.9.1-victorialogs","v1.110.1","v1.102.13","v1.9.0-victorialogs","v1.109.0","v1.97.17","v1.102.12","v1.97.16","v1.102.11","v1.8.0-victorialogs","v1.7.0-victorialogs","v1.109.1","v1.6.1-victorialogs","v1.6.0-victorialogs","v1.97.15","v1.102.10","v1.5.0-victorialogs","v1.4.0-victorialogs","v1.108.1","v1.97.14","v1.102.9","v1.3.2-victorialogs","v1.3.1-victorialogs","v1.3.0-victorialogs","v1.2.0-victorialogs","v1.1.0-victorialogs","v1.97.13","v1.102.8","v1.106.1","v1.97.12","v1.102.7","v1.0.0-victorialogs","v0.42.0-victorialogs","v0.41.0-victorialogs","v1.97.11","v1.102.6","v1.106.0","v0.40.0-victorialogs","v0.39.0-victorialogs","v0.38.0-victorialogs","v1.97.10","v1.105.0","v1.102.5","v0.37.0-victorialogs","v0.36.0-victorialogs","v0.35.0-victorialogs","v0.34.0-victorialogs","v1.104.0","v1.97.9","v1.102.4","v0.33.0-victorialogs","v0.32.1-victorialogs","v0.32.0-victorialogs","v0.31.0-victorialogs","v0.30.1-victorialogs","v0.30.0-victorialogs","v1.97.8","v1.102.3","v0.29.0-victorialogs","v1.97.7","v1.102.2","v1.102.1","v1.102.0","v0.28.0-victorialogs","v0.27.1-victorialogs","v0.27.0-victorialogs","v0.26.1-victorialogs","v0.26.0-victorialogs","v0.25.0-victorialogs","v0.24.0-victorialogs","v0.23.0-victorialogs","v1.102.0-rc2","v0.22.0-victorialogs","v0.21.0-victorialogs","v0.20.2-victorialogs","v0.20.1-victorialogs","v0.20.0-victorialogs","v0.19.0-victorialogs","v1.102.0-rc1","v0.18.0-victorialogs","v0.17.0-victorialogs","v0.16.0-victorialogs","v0.15.0-victorialogs","v0.14.0-victorialogs","v0.13.0-victorialogs","v0.12.1-victorialogs","v0.12.0-victorialogs","v0.11.0-victorialogs","v0.10.0-victorialogs","v0.9.1-victorialogs","v0.9.0-victorialogs","v0.8.0-victorialogs","v0.7.0-victorialogs","v0.6.1-victorialogs","v0.6.0-victorialogs","v1.101.0","v1.100.1","v0.5.2-victorialogs","v0.5.1-victorialogs","v1.100.0","v1.99.0","v1.97.3","v0.5.0-victorialogs","v1.97.2","v1.98.0","v1.97.1","v1.97.6","v1.97.5","v1.97.4","v1.97.0","v1.96.0","v1.95.1","v0.4.2-victorialogs","v1.95.0","v0.4.0-victorialogs","v1.94.0","v1.93.0","v1.92.1","v1.92.0","v0.3.0-victorialogs","v0.2.0-victorialogs","v1.91.2","v0.1.0-victorialogs","v1.91.1","v1.91.0","v1.90.0","v1.89.1","v1.89.0","v1.88.1","v1.88.0","v1.87.1","v1.87.0","v1.86.2","v1.86.1","v1.86.0","v1.85.3","v1.85.2","v1.85.1","v1.85.0","v1.84.0","v1.83.1","v1.83.0","v1.82.0","v1.81.1","v1.81.0","v1.80.0","v1.79.0","v1.78.0","v1.77.2","v1.77.1","v1.77.0","v1.76.1","v1.76.0","v1.75.0","v1.74.0","v1.73.1","v1.73.0","v1.72.0","v1.71.0","v1.70.0","v1.69.0","v1.68.0","v1.67.0","v1.66.2","v1.66.1","v1.66.0","v1.65.0","v1.64.1","v1.64.0","v1.63.0","v1.62.0","v1.61.1","v1.61.0","v1.60.0","v1.59.0","v1.58.0","v1.57.1","v1.57.0","v1.56.0","v1.55.1","v1.55.0","v1.54.1","v1.54.0","v1.53.0","v1.52.0","v1.51.0","v1.50.2","v1.50.1","v1.50.0","v1.49.0","v1.48.0","v1.47.0","v1.46.0","v1.45.0","v1.44.0","v1.43.0","v1.42.0","v1.41.1","v1.41.0","v1.40.1","v1.40.0","v1.39.4","v1.39.3","v1.39.2","v1.39.1","v1.39.0","v1.38.1","v1.38.0","v1.37.4","v1.37.3","v1.37.2","v1.37.1","v1.37.0","v1.36.3","v1.36.2","v1.36.1","v1.36.0","v1.35.6","v1.35.5","v1.35.4","v1.35.3","v1.35.2","v1.35.1","v1.35.0","v1.34.9","v1.34.8","v1.34.7","v1.34.6","v1.34.5","v1.34.4","v1.34.3","v1.34.2","v1.34.1","v1.34.0","v1.33.1","v1.33.0","v1.32.8","v1.32.7","v1.32.6","v1.32.5","v1.32.4","v1.32.3","v1.32.2","v1.32.1","v1.32.0","v1.31.5","v1.31.4","v1.31.3","v1.31.2","v1.31.1","v1.31.0","v1.30.6","v1.30.5","v1.30.4","v1.30.3","v1.30.2","v1.30.1","v1.30.0","v1.29.5","v1.29.4","v1.29.3","v1.29.2","v1.29.1","v1.29.0","v1.28.3","v1.28.2","v1.28.1","v1.28.0","v1.28.0-beta6","v1.28.0-beta5","v1.28.0-beta4","v1.28.0-beta3","v1.28.0-beta2","v1.28.0-beta1","v1.27.3","v1.27.2","v1.27.1","v1.27.0","v1.26.0","v1.25.2","v1.25.1","v1.25.0","v1.24.1","v1.24.0","v1.23.1","v1.23.0","v1.22.2","v1.22.1","v1.22.0","v1.21.2","v1.21.1","v1.21.0","v1.20.7","v1.20.6","v1.20.5","v1.20.4","v1.20.3","v1.20.2","v1.20.1","v1.20.0","v1.19.4","v1.19.3","v1.19.2","v1.19.1","v1.19.0","v1.18.11","v1.18.10","v1.18.9","v1.18.8","v1.18.7","v1.18.6","v1.18.5","v1.18.4","v1.18.3","v1.18.1","v1.18.0","v1.17.5","v1.17.4","v1.17.3","v1.17.2","v1.17.1","v1.17.0","v1.16.0","v1.15.2","v1.15.1","v1.15.0","v1.14.2","v1.14.1","v1.14.0","v1.13.1","v1.13.0","v1.12.6","v1.12.5","v1.12.4","v1.12.3","v1.12.2","v1.12.1","v1.12.0","v1.11.4","v1.9.0","v1.8.2","v1.8.1","v1.8.0","v1.7.6","v1.7.5","v1.11.3","v1.11.2","v1.11.1","v1.11.0","v1.10.1","v1.10.0","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0","v1.6.2","v1.6.1","v1.6.0","v1.5.1","v1.5.0","v1.4.0","v1.3.2","v1.3.1","v1.3.0","v1.2.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61625.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N"}]}