Vulnerability · Published Aug 25, 2026 · Assigned by GitHub_M

CVE-2026-32637Velero vulnerable to file path traversal when extracting from backup's tarball

Medium 5.9

In plain English

A medium-severity path traversal in velero from velero-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)5.9Medium

Exploit odds (30 days)0.5%top 54.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/vmware-tanzu/velero	1.18.1	GHSA-j2g6-362q-6qc6
Go	github.com/vmware-tanzu/velero	1.18.1	GO-2026-6259

Affected products (as reported)

Vendor	Product	Versions
velero-io	velero	< 1.18.1

Weakness: CWE-22 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

References

https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6 x_refsource_CONFIRM
https://github.com/securego/gosec/issues/324 x_refsource_MISC
https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0 x_refsource_MISC
https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c x_refsource_MISC