https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Fri, 04 Sep 2026 21:32:22 +0000 https://vulnerability.circl.lu/sighting/eff9e6e2-b9df-491b-bd6a-a42e85e050cd/export {"uuid": "eff9e6e2-b9df-491b-bd6a-a42e85e050cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61625", "type": "seen", "source": "https://gist.github.com/alon710/c6744c105236e73d40303105f85b8498", "content": "# CVE-2026-61625: CVE-2026-61625: Arbitrary File Write via Path Traversal in VictoriaMetrics vmrestore\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61625\n\n## Summary\nCVE-2026-61625 is a path traversal vulnerability (CWE-22) within the `vmrestore` utility of VictoriaMetrics. When restoring database shards from a compromised or malicious backup source, the application fails to validate the paths of backup parts before creating and writing files. By injecting objects with directory traversal sequences (such as `../`) into the remote backup storage, an attacker can write arbitrary files to out-of-bounds locations on the system executing the restore operation. Depending on the process privileges, this can result in host compromise via remote code execution.\n\n## TL;DR\nA directory traversal flaw in the VictoriaMetrics `vmrestore` utility enables attackers with write access to the backup store to execute arbitrary file writes on the restoration host, which can lead to remote code execution.\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.8 (Medium)\n- **EPSS Score**: 0.00303 (0.30% probability of active exploitation in 30 days)\n- **Exploit Status**: None (No public functional exploits available)\n- **CISA KEV Status**: Not Listed\n- **Impact**: Arbitrary File Write / Remote Code Execution\n\n## Affected Systems\n\n- VictoriaMetrics vmrestore\n- VictoriaMetrics backup-restore workflows\n- **VictoriaMetrics**: < 1.122.25 (Fixed in: `1.122.25`)\n- **VictoriaMetrics**: >= 1.123.0, < 1.136.12 (Fixed in: `1.136.12`)\n- **VictoriaMetrics**: >= 1.137.0, < 1.146.0 (Fixed in: `1.146.0`)\n\n## Mitigation\n\n- Restrict write and modification access to remote backup stores (S3, GCS, Azure Blob) using strict IAM policies.\n- Scan remote backup object keys for the presence of relative path sequences (such as '../') before invoking the restoration utility.\n- Upgrade VictoriaMetrics vmrestore to patched releases immediately.\n\n**Remediation Steps:**\n1. Identify all deployment instances of the `vmrestore` binary in automated pipelines or operator environments.\n2. Update the binary to version 1.122.25, 1.136.12, or 1.146.0 or newer.\n3. Verify the upgrade by reviewing the version output and checking compatibility logs.\n4. Implement AWS S3 or bucket-level access control restrictions to enforce read-only credentials for restoration tasks.\n\n## References\n\n- [VictoriaMetrics GHSA Security Advisory](https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-8q3c-rjr9-xxrp)\n- [Fix Commit 710c920d6083327042a309e449fae4383617d817](https://github.com/VictoriaMetrics/VictoriaMetrics/commit/710c920d6083327042a309e449fae4383617d817)\n- [VictoriaMetrics Release v1.122.25](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25)\n- [VictoriaMetrics Release v1.136.12](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12)\n- [VictoriaMetrics Release v1.146.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0)\n- [CVE-2026-61625 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-61625)\n- [NVD Vulnerability Details for CVE-2026-61625](https://nvd.nist.gov/vuln/detail/CVE-2026-61625)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61625) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T18:33:18.164730Z"} {"uuid": "eff9e6e2-b9df-491b-bd6a-a42e85e050cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-61625", "type": "seen", "source": "https://gist.github.com/alon710/c6744c105236e73d40303105f85b8498", "content": "# CVE-2026-61625: CVE-2026-61625: Arbitrary File Write via Path Traversal in VictoriaMetrics vmrestore\n\n> **CVSS Score:** 6.8\n> **Published:** 2026-09-03\n> **Full Report:** https://cvereports.com/reports/CVE-2026-61625\n\n## Summary\nCVE-2026-61625 is a path traversal vulnerability (CWE-22) within the `vmrestore` utility of VictoriaMetrics. When restoring database shards from a compromised or malicious backup source, the application fails to validate the paths of backup parts before creating and writing files. By injecting objects with directory traversal sequences (such as `../`) into the remote backup storage, an attacker can write arbitrary files to out-of-bounds locations on the system executing the restore operation. Depending on the process privileges, this can result in host compromise via remote code execution.\n\n## TL;DR\nA directory traversal flaw in the VictoriaMetrics `vmrestore` utility enables attackers with write access to the backup store to execute arbitrary file writes on the restoration host, which can lead to remote code execution.\n\n## Technical Details\n\n- **CWE ID**: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.8 (Medium)\n- **EPSS Score**: 0.00303 (0.30% probability of active exploitation in 30 days)\n- **Exploit Status**: None (No public functional exploits available)\n- **CISA KEV Status**: Not Listed\n- **Impact**: Arbitrary File Write / Remote Code Execution\n\n## Affected Systems\n\n- VictoriaMetrics vmrestore\n- VictoriaMetrics backup-restore workflows\n- **VictoriaMetrics**: < 1.122.25 (Fixed in: `1.122.25`)\n- **VictoriaMetrics**: >= 1.123.0, < 1.136.12 (Fixed in: `1.136.12`)\n- **VictoriaMetrics**: >= 1.137.0, < 1.146.0 (Fixed in: `1.146.0`)\n\n## Mitigation\n\n- Restrict write and modification access to remote backup stores (S3, GCS, Azure Blob) using strict IAM policies.\n- Scan remote backup object keys for the presence of relative path sequences (such as '../') before invoking the restoration utility.\n- Upgrade VictoriaMetrics vmrestore to patched releases immediately.\n\n**Remediation Steps:**\n1. Identify all deployment instances of the `vmrestore` binary in automated pipelines or operator environments.\n2. Update the binary to version 1.122.25, 1.136.12, or 1.146.0 or newer.\n3. Verify the upgrade by reviewing the version output and checking compatibility logs.\n4. Implement AWS S3 or bucket-level access control restrictions to enforce read-only credentials for restoration tasks.\n\n## References\n\n- [VictoriaMetrics GHSA Security Advisory](https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-8q3c-rjr9-xxrp)\n- [Fix Commit 710c920d6083327042a309e449fae4383617d817](https://github.com/VictoriaMetrics/VictoriaMetrics/commit/710c920d6083327042a309e449fae4383617d817)\n- [VictoriaMetrics Release v1.122.25](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25)\n- [VictoriaMetrics Release v1.136.12](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12)\n- [VictoriaMetrics Release v1.146.0](https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0)\n- [CVE-2026-61625 Record on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-61625)\n- [NVD Vulnerability Details for CVE-2026-61625](https://nvd.nist.gov/vuln/detail/CVE-2026-61625)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-61625) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-03T18:33:18.164730Z"} https://vulnerability.circl.lu/sighting/eff9e6e2-b9df-491b-bd6a-a42e85e050cd/export Thu, 03 Sep 2026 18:33:18 +0000