Vulnerabilities

TI-2026-86089 CVE-2026-124029 · GHSA-wxf6-4gvx-qq4q

Kopia Path Traversal in Snapshot Restore via Directory Entry Names

LOW 30

Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names.

CVSS 4.0MEDIUM 6.9 Network Low privileges User interaction EPSS 0.00267 Published 2026-11-06 No fix listed CWE-22

TI-2026-33436 CVE-2026-45695 · GHSA-2q4c-3mrw-63c3

Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used

MEDIUM 52

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0161 Published 2026-07-16 Partial fix · 0.23.0 CWE-306

Vulnerabilities

Filters

Kopia Path Traversal in Snapshot Restore via Directory Entry Names

Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used