MEDIUM 6.9 NVD
CVE-2026-124029
Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore direct
Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory.
References
- https://github.com/kopia/kopia
- https://github.com/kopia/kopia/blob/v0.23.1/snapshot/restore/restore.go#L397
- https://github.com/kopia/kopia/issues/5700
- https://www.vulncheck.com/advisories/kopia-through-0.23.1-path-traversal-in-snapshot-resto
This medium severity vulnerability with a CVSS score of 6.9 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.