GHSA-j2g6-362q-6qc6

Source

https://github.com/advisories/GHSA-j2g6-362q-6qc6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-j2g6-362q-6qc6/GHSA-j2g6-362q-6qc6.json

JSON Data

https://api.test.osv.dev/v1/vulns/GHSA-j2g6-362q-6qc6

Aliases

Downstream

CGA (22)

MINI (16)

Published

2026-08-20T17:26:07Z

Modified

2026-08-25T20:26:09Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Velero vulnerable to file path traversal when extracting from backup's tarball

Details

Impact

What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following:

../../../tmp/escape_1 -> file created at /tmp/escape_1
../../../../../../../../tmp/escape_2 -> file created at /tmp/escape_2
../../../tmp/cron_poc -> would be /etc/cron.d/backdoor in real attack
../../../tmp/ssh_poc -> would be ~/.ssh/authorized_keys
../../../tmp/kubeconfig_poc -> would be ~/.kube/config

It's possible that extracting files from the tarball during restore can overwrite sensitive files in the Velero pod filesystem.

Patches

Has the problem been patched? What versions should users upgrade to?

By far, there is no patch yet. We are working on the main branch, then cherry-pick to the release-1.18 for v1.18.1 patch.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no workaround, but the good news is that keeping your OSS safe will prevent the vulnerability.

Database specific

{
    "cwe_ids":  [
        "CWE-22"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-20T17:26:07Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}

References

Affected packages

Go / github.com/vmware-tanzu/velero

Package

Name: github.com/vmware-tanzu/velero; View open source insights on deps.dev
Purl: pkg:golang/github.com/vmware-tanzu/velero

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.18.1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-j2g6-362q-6qc6/GHSA-j2g6-362q-6qc6.json"