CVE-2026-62268

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62268", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-13T17:09:57.574Z", "datePublished": "2026-11-05T20:28:48.031Z", "dateUpdated": "2026-11-09T22:53:59.897Z"}, "containers": {"cna": {"title": "borg extract might modify out-of-tree files when extracting maliciously crafted archives", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"}, {"name": "https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224"}, {"name": "https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d"}, {"name": "https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640"}, {"name": "https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f"}, {"name": "https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329"}, {"name": "https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b"}, {"name": "https://github.com/borgbackup/borg/releases/tag/1.4.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/releases/tag/1.4.5"}, {"name": "https://github.com/borgbackup/borg/releases/tag/2.0.0b22", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/releases/tag/2.0.0b22"}], "affected": [{"vendor": "borgbackup", "product": "borg", "versions": [{"version": "< 1.4.5", "status": "affected"}, {"version": ">= 2.0.0b1, < 2.0.0b22", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:28:48.031Z"}, "descriptions": [{"lang": "en", "value": "borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22."}], "source": {"advisory": "GHSA-gfp8-w835-v44j", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-09T22:53:46.813570Z", "id": "CVE-2026-62268", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:53:59.897Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-62268", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-07-13T17:09:57.574Z", "datePublished": "2026-11-05T20:28:48.031Z", "dateUpdated": "2026-11-09T22:53:59.897Z"}, "containers": {"cna": {"title": "borg extract might modify out-of-tree files when extracting maliciously crafted archives", "problemTypes": [{"descriptions": [{"cweId": "CWE-59", "lang": "en", "description": "CWE-59: Improper Link Resolution Before File Access ('Link Following')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"}, {"name": "https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224"}, {"name": "https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d"}, {"name": "https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640"}, {"name": "https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f"}, {"name": "https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329"}, {"name": "https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b"}, {"name": "https://github.com/borgbackup/borg/releases/tag/1.4.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/releases/tag/1.4.5"}, {"name": "https://github.com/borgbackup/borg/releases/tag/2.0.0b22", "tags": ["x_refsource_MISC"], "url": "https://github.com/borgbackup/borg/releases/tag/2.0.0b22"}], "affected": [{"vendor": "borgbackup", "product": "borg", "versions": [{"version": "< 1.4.5", "status": "affected"}, {"version": ">= 2.0.0b1, < 2.0.0b22", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-11-05T20:28:48.031Z"}, "descriptions": [{"lang": "en", "value": "borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22."}], "source": {"advisory": "GHSA-gfp8-w835-v44j", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-62268", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T22:53:46.813570Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T22:53:55.037Z"}}]}}

{"affected": [{"affectedData": [{"product": "borg", "vendor": "borgbackup", "versions": [{"status": "affected", "version": "< 1.4.5"}, {"status": "affected", "version": ">= 2.0.0b1, < 2.0.0b22"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22."}], "id": "CVE-2026-62268", "lastModified": "2026-11-12T22:18:51.470", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-62268", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-09T22:53:46.813570Z", "version": "2.0.3"}}]}, "published": "2026-11-05T21:18:52.133", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224"}, {"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d"}, {"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640"}, {"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f"}, {"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329"}, {"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b"}, {"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/releases/tag/1.4.5"}, {"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/releases/tag/2.0.0b22"}, {"source": "security-advisories@github.com", "url": "https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-59"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "borgbackup: borgbackup: Arbitrary file overwrite via path traversal during archive extraction", "id": "2567821", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567821"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:N", "status": "draft"}, "cwe": "CWE-22", "details": ["A flaw was found in borgbackup. This flaw allows arbitrary file overwrite, deletion, or information disclosure during archive extraction. The application fails to properly validate path targets, allowing symbolic links, directory traversal sequences, and external hard links to escape the target extraction directory. An attacker with access to a backup repository could craft a malicious archive that, when extracted by a user, modifies files outside the destination directory or exposes sensitive local files."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict access to backup repositories and isolate extraction operations:\n1. Operational controls: Ensure repository storage access, SSH keys, and Borg encryption passphrases are restricted to trusted personnel to prevent unauthorized users from committing crafted archive data. Avoid extracting archives received from untrusted or unverified sources.\n2. Sandboxing: When restoring or inspecting potentially untrusted backup archives, execute the extraction process inside an isolated, unprivileged container or sandbox environment with restricted filesystem mount permissions. This limits the blast radius of any directory traversal or out-of-tree file overwrite.\nCaveats: Extracting within a sandboxed or containerized environment introduces operational overhead and requires manual verification before transferring restored files to production paths."}, "name": "CVE-2026-62268", "public_date": "2026-11-05T20:28:48Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-62268\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-62268\nhttps://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224\nhttps://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d\nhttps://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640\nhttps://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f\nhttps://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329\nhttps://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b\nhttps://github.com/borgbackup/borg/releases/tag/1.4.5\nhttps://github.com/borgbackup/borg/releases/tag/2.0.0b22\nhttps://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires high privileges, including direct write access to the backup repository and knowledge of the repository encryption passphrase or key, followed by user interaction to extract the archive. In typical enterprise deployments, backup extraction is an administrative operation performed in controlled environments from trusted repositories. Although an untrusted archive could lead to unauthorized file manipulation or data exposure outside the intended destination directory, the prerequisite of possessing authenticated repository access substantially limits practical risk.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.4.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[2.0.0b1,2.0.0b22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "borg", "source": "cna", "vendor": "borgbackup"}, "product": "borg", "vendor": "borgbackup"}], "created": "2026-11-05T21:45:05.120955+00:00", "updated": "2026-11-06T14:30:06.074369+00:00", "vendors": ["borgbackup", "borgbackup$PRODUCT$borg"], "weaknesses": ["CWE-22", "CWE-59"]}