Velero vulnerable to file path traversal when extracting from backup's tarball
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- Partial Red Hat: 4 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| velero-io | velero | before 1.18.1 | 1.18.1 | Patch available | CNA |
| — | github.com/vmware-tanzu/velero (Go) | before 1.18.1 | 1.18.1 | Patch available | GHSA-j2g6-362q-6qc6 |
- velero Vendorvelero-io Affected before 1.18.1 Fixed in 1.18.1 Patch available CNA
- github.com/vmware-tanzu/velero (Go) Vendor— Affected before 1.18.1 Fixed in 1.18.1 Patch available GHSA-j2g6-362q-6qc6
Remediation
- Fix · CNA velero (velero-io) Fixed in 1.18.1
- Fix · GHSA-j2g6-362q-6qc6 github.com/vmware-tanzu/velero (Go) Fixed in 1.18.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| OpenShift API for Data Protection | Affected | No fix yet: Fix deferred |
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet: Fix deferred |
| Red Hat Openshift Data Foundation 4 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2026-32637
- 2026-10-03 Alias added: GHSA-j2g6-362q-6qc6
References
Other 5
- https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6
- https://github.com/securego/gosec/issues/324
- https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0
- https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c
- https://github.com/velero-io/velero
Sources
- CVE-2026-32637 · CVE Program
- CVE-2026-32637 · NVD
- FIRST EPSS
- GHSA-j2g6-362q-6qc6 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-32637 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences