Read the docs
TI-2026-79625 Aliases CVE-2026-63120

Path traversal in PGHoard restore allows arbitrary file writes

Priority LOW 39CWE-22Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
Required
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

Aiven-Open pghoard before 2.7.2 has an incomplete fix for path traversal (CWE-22) in its restore tooling. An attacker with write access to the backup object storage, such as S3, GCS or Azure, can craft a delta backup manifest that writes files and creates directories outside the PostgreSQL data directory. The files are written when a database administrator runs a restore with pghoard_restore get-basebackup.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00401 34th percentileScored 2026-11-07
Fix Fixed pghoard (Aiven-Open): 2.7.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Aiven-Openpghoardbefore 2.7.22.7.2Patch availableCNA
  • pghoard VendorAiven-Open Affected before 2.7.2 Fixed in 2.7.2 Patch available CNA

Remediation

Upgrade pghoard to version 2.7.2, which patches this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA pghoard (Aiven-Open) Fixed in 2.7.2

Timeline

  1. 2026-10-23 Threatist record created from CVE-2026-63120
  2. 2026-10-23 CISA SSVC decision points changed
  3. 2026-10-23 Priority changed: MEDIUM → LOW

References

Other 2

  • TI-2025-38105 Karapace is vulnerable to Authentication Bypass CVSS 3.1HIGH 8.6
  • TI-2025-34940 aiven-db-migrate allows Privilege Escalation through use of psql during migration CVSS 3.1CRITICAL 9.1
  • TI-2025-22661 aiven-extras allows PostgreSQL Privilege Escalation through format function CVSS 3.1CRITICAL 9.1
  • TI-2025-34939 aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration CVSS 3.1CRITICAL 9.1
  • TI-2023-15599 aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path CVSS 3.1HIGH 8.8
  • TI-2026-32927 Klaw: Improper Access Control Allows Disclosure of Password Hash CVSS 4.0MEDIUM 6.9
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences