AIKIDO-2026-616987

borgbackup is vulnerable to Path Traversal

Path TraversalCVE-2026-62268 Published 5 days ago

Low Risk

This Affects:

borgbackup

0.23.0 - 1.4.4

Fixed in 1.4.5

Are you affected? Scan for Free

TL;DR

The archive extraction code in borg builds output paths from names stored inside the archive without fully validating their parent components. A crafted archive whose entries contain embedded .. segments, symlinked or non-directory parent components, or hardlinks whose source path is unsafe can make borg act outside the intended extraction directory. This has two effects: files can be created, overwritten, or deleted at chosen locations on the filesystem of the account running the extraction (integrity), and a hardlink whose source resolves through a symlink or .. can link an arbitrary external file (for example /etc/shadow) into the extracted tree, exposing its contents (information disclosure, especially when restoring as root). The fix adds a _check_safe_parent() guard that rejects unsafe parent paths, validates the hardlink source before calling os.link(), and links with follow_symlinks=False where supported.

Who does this affect?

You are affected if you run a version in the vulnerable range and you extract an archive whose contents were produced or modified by an untrusted party with write access to the repository (and, for encrypted or authenticated repositories, the borg key and passphrase). Archives that borg itself created are safe because borg stores normalized relative paths and never follows symlinks; the risk is limited to restoring archives from a repository you do not fully control.