CVE-2026-32637

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-32637
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32637.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-32637
Aliases
Downstream
CGA (30)
CLEANSTART (2)
MINI (16)
openSUSE (1)
SUSE (1)
Related
Published
2026-08-25T21:15:31Z
Modified
2026-10-22T10:31:27Z
Severity
  • 5.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Velero vulnerable to file path traversal when extracting from backup's tarball
Details

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/32xxx/CVE-2026-32637.json"
}
References

Affected packages

Git / github.com/velero-io/velero

Affected ranges

Type
GIT
Repo
https://github.com/velero-io/velero
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
26ef8fa7df68dfa9ab8aa4669b8ac47340b0c510
Fixed
3f8e3588496391979915ace065f732a9013c1cf0
Fixed
c7fa4bfe3571667e9731f3f504da3c6be709a24c
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.18.1"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "3f8e3588496391979915ace065f732a9013c1cf0"
                }
            ],
            "source": "REFERENCES_COMMIT"
        },
        {
            "range": [
                {
                    "fixed": "c7fa4bfe3571667e9731f3f504da3c6be709a24c"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*
v0.10.0
v0.10.0-beta.1
v0.10.1
v0.11.0
v0.3.0
v0.3.1
v0.3.2
v0.3.3
v0.4.0
v0.5.0
v0.6.0
v0.7.0
v0.7.1
v0.8.0
v0.8.0-rc.1
v0.8.1
v0.9.0
v0.9.0-alpha.1
v0.9.0-alpha.2
v0.9.0-alpha.3
v1.*
v1.0.0
v1.0.0-alpha.1
v1.0.0-alpha.2
v1.0.0-beta.1
v1.0.0-rc.1
v1.1.0
v1.1.0-beta.1
v1.1.0-beta.2
v1.10.0-rc.1
v1.18.0
v1.18.0-rc.1
v1.18.0-rc.2
v1.18.1-rc.1
v1.18.1-rc.2
v1.2.0
v1.2.0-beta.1
v1.3.0
v1.3.0-beta.1
v1.3.0-beta.2
v1.4.0
v1.4.0-beta.1
v1.5.0-beta.1
v1.5.0-rc.1
v1.5.1
v1.6.0
v1.6.0-rc.1
v1.6.0-rc.2
v1.7.0-rc.1
v1.9.0-rc.2

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-32637.json"