Borg (aka BorgBackup) before 1.0.9 has a flaw in the way duplicate archive names were processed during manifest recovery, potentially allowing an attacker to overwrite an archive.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2016-10100.json"
[ { "events": [ { "introduced": "0" }, { "last_affected": "1.0.8" } ] } ]