MEDIUM GitHub
CVE-2026-32637
Velero vulnerable to file path traversal when extracting from backup's tarball
### Impact
_What kind of vulnerability is it? Who is impacted?_
If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following:
* ../../../tmp/escape_1 -> file created at /tmp/escape_1
* ../../../../../../../../tmp/escape_2 -> file created at /tmp/escape_2
* ../../../tmp/cron_poc -> would be /etc/cron.d/backdoor in real attack
* ../../../tmp/ssh_poc -> would be ~/.ssh/authorize
Affected Products
- go/github.com/vmware-tanzu/velero < 1.18.1
References
- https://github.com/advisories/GHSA-j2g6-362q-6qc6
- https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6
- https://github.com/securego/gosec/issues/324
- https://github.com/advisories/GHSA-j2g6-362q-6qc6
This medium severity vulnerability was published on 2026-08-20 via GitHub. Affected: go/github.com/vmware-tanzu/velero < 1.18.1.
vulnfeed aggregates 11796 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.