MEDIUM GitHub
CVE-2026-62268
borg extract might modify out-of-tree files when extracting maliciously crafted archives
### Impact
A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd").
When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory.
In a quite similar scenario, a crafted archive could contain a slave hardlink item with the hardlink source pointing outside the extraction directory.
Affected Products
- pip/borgbackup < 1.4.5
- pip/borgbackup >= 2.0.0b1, < 2.0.0b22
References
- https://github.com/advisories/GHSA-gfp8-w835-v44j
- https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j
- https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224
- https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d
This medium severity vulnerability was published on 2026-10-15 via GitHub. Affected: pip/borgbackup < 1.4.5, pip/borgbackup >= 2.0.0b1, < 2.0.0b22.
vulnfeed aggregates 14677 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.