CVE-2026-32637CWE-22path-traversal

CVE-2026-32637

published August 26, 2026

CVSS
5.9
EPSS
1%
Percentile
44.9
In the wild
Unconfirmed
What it is

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

The record
Technical detail
CVSS
5.9 · NONE
CVSS v4.0
5.9 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00544 · 44.9th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2026-08-26T02:17Z
References (4)
https://github.com/securego/gosec/issues/324 · [email protected]https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0 · [email protected]https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c · [email protected]https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6 · [email protected]
EPSS history
Timeline
  • 27 AUG 06:26Z
    EPSS moved — → 1%
    epss
  • 25 AUG 21:15Z
    Velero vulnerable to file path traversal when extracting from backup's tarball
    cvelistv5