Log in Start free

Vulnerability · Published Aug 20, 2026 · Assigned by GitHub_M

CVE-2026-61625VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root

Medium 6.8

In plain English

A medium-severity path traversal in VictoriaMetrics from VictoriaMetrics. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.4%top 65.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gogithub.com/VictoriaMetrics/VictoriaMetrics1.146.0GHSA-8q3c-rjr9-xxrp
Gogithub.com/VictoriaMetrics/VictoriaMetrics1.136.12GHSA-8q3c-rjr9-xxrp
Gogithub.com/VictoriaMetrics/VictoriaMetrics1.122.25GHSA-8q3c-rjr9-xxrp
Gogithub.com/VictoriaMetrics/VictoriaMetrics1.122.25, 1.136.12, 1.146.0GO-2026-6366

Affected products (as reported)

VendorProductVersions
VictoriaMetrics VictoriaMetrics >= 1.137.0, < 1.146.0>= 1.123.0, < 1.136.12< 1.122.25

Weakness: CWE-22 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

References