Kopia Path Traversal in Snapshot Restore via Directory Entry Names
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Passive
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Kopia through 0.23.1 contains a path traversal flaw in copyDirectoryContent that lets users with repository write access escape the restore directory. An attacker can create snapshots whose directory manifest entries are named '..', so victims restoring with default options have attacker-chosen content written outside the restore directory.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
The sources list no fixed version for Kopia.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Timeline
- 2026-11-06 Threatist record created from CVE-2026-124029
- 2026-11-06 Alias added: GHSA-wxf6-4gvx-qq4q
- 2026-11-08 Priority changed: MEDIUM → LOW
References
More kopia vulnerabilities
- TI-2026-33436 Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used CVSS 3.1CRITICAL 9.8
Sources
- CVE-2026-124029 · CVE Program
- CVE-2026-124029 · NVD
- FIRST EPSS
- GHSA-wxf6-4gvx-qq4q · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences