CVE-2026-32637

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32637", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-12T15:29:36.559Z", "datePublished": "2026-08-25T21:15:31.881Z", "dateUpdated": "2026-08-28T22:38:21.971Z"}, "containers": {"cna": {"title": "Velero vulnerable to file path traversal when extracting from backup's tarball", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6"}, {"name": "https://github.com/securego/gosec/issues/324", "tags": ["x_refsource_MISC"], "url": "https://github.com/securego/gosec/issues/324"}, {"name": "https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0", "tags": ["x_refsource_MISC"], "url": "https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0"}, {"name": "https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c", "tags": ["x_refsource_MISC"], "url": "https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c"}], "affected": [{"vendor": "velero-io", "product": "velero", "versions": [{"version": "< 1.18.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-25T21:15:31.881Z"}, "descriptions": [{"lang": "en", "value": "Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1."}], "source": {"advisory": "GHSA-j2g6-362q-6qc6", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-28T22:38:12.852792Z", "id": "CVE-2026-32637", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T22:38:21.971Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32637", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-12T15:29:36.559Z", "datePublished": "2026-08-25T21:15:31.881Z", "dateUpdated": "2026-08-28T22:38:21.971Z"}, "containers": {"cna": {"title": "Velero vulnerable to file path traversal when extracting from backup's tarball", "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "lang": "en", "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6"}, {"name": "https://github.com/securego/gosec/issues/324", "tags": ["x_refsource_MISC"], "url": "https://github.com/securego/gosec/issues/324"}, {"name": "https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0", "tags": ["x_refsource_MISC"], "url": "https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0"}, {"name": "https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c", "tags": ["x_refsource_MISC"], "url": "https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c"}], "affected": [{"vendor": "velero-io", "product": "velero", "versions": [{"version": "< 1.18.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-25T21:15:31.881Z"}, "descriptions": [{"lang": "en", "value": "Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1."}], "source": {"advisory": "GHSA-j2g6-362q-6qc6", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32637", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-28T22:38:12.852792Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-28T22:38:17.901Z"}}]}}

{"affected": [{"affectedData": [{"product": "velero", "vendor": "velero-io", "versions": [{"status": "affected", "version": "< 1.18.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1."}], "id": "CVE-2026-32637", "lastModified": "2026-09-09T21:09:13.080", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-32637", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-28T22:38:12.852792Z", "version": "2.0.3"}}]}, "published": "2026-08-25T22:17:02.380", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/securego/gosec/issues/324"}, {"source": "security-advisories@github.com", "url": "https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0"}, {"source": "security-advisories@github.com", "url": "https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c"}, {"source": "security-advisories@github.com", "url": "https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "github.com/vmware-tanzu/velero: Velero: File path traversal allows overwriting sensitive files via malicious backup tarball.", "id": "2524138", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2524138"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-22", "details": ["Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.", "A flaw was found in Velero, an open-source tool for managing Kubernetes backups. An attacker who compromises the backup object-storage backend can upload a specially crafted malicious backup file. During the restore process, this malicious file can exploit a path traversal vulnerability to overwrite sensitive files within the Velero pod's filesystem. This could lead to unauthorized modification of critical system files."], "name": "CVE-2026-32637", "package_state": [{"cpe": "cpe:/a:redhat:rhmt:1", "fix_state": "Fix deferred", "package_name": "rhmtc/openshift-migration-controller-rhel8", "product_name": "Migration Toolkit for Containers"}, {"cpe": "cpe:/a:redhat:openshift_api_data_protection:1", "fix_state": "Fix deferred", "package_name": "oadp/oadp-kubevirt-velero-plugin-rhel9", "product_name": "OpenShift API for Data Protection"}, {"cpe": "cpe:/a:redhat:openshift_api_data_protection:1", "fix_state": "Fix deferred", "package_name": "oadp/oadp-mustgather-rhel9", "product_name": "OpenShift API for Data Protection"}, {"cpe": "cpe:/a:redhat:openshift_api_data_protection:1", "fix_state": "Fix deferred", "package_name": "oadp/oadp-velero-restic-restore-helper-rhel9", "product_name": "OpenShift API for Data Protection"}, {"cpe": "cpe:/a:redhat:openshift_api_data_protection:1", "fix_state": "Fix deferred", "package_name": "oadp/oadp-velero-rhel9", "product_name": "OpenShift API for Data Protection"}, {"cpe": "cpe:/a:redhat:acm:2", "fix_state": "Fix deferred", "package_name": "rhacm2/cluster-backup-rhel9-operator", "product_name": "Red Hat Advanced Cluster Management for Kubernetes 2"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/lifecycle-agent-operator-bundle", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift4/lifecycle-agent-rhel9-operator", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift_data_foundation:4", "fix_state": "Fix deferred", "package_name": "odf4/odr-rhel9-operator", "product_name": "Red Hat Openshift Data Foundation 4"}], "public_date": "2026-08-25T21:15:31Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-32637\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-32637\nhttps://github.com/securego/gosec/issues/324\nhttps://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0\nhttps://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c\nhttps://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.18.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "velero", "source": "cna", "vendor": "velero-io"}, "product": "velero", "vendor": "velero-io"}], "created": "2026-08-26T01:30:16.695548+00:00", "updated": "2026-08-28T20:34:23.049647+00:00", "vendors": ["velero-io", "velero-io$PRODUCT$velero"]}