CVE-2026-64824
Received Received - Intake

Path Traversal in Home Assistant Core Backup-Restore

Publication date: 2026-07-21

Last updated on: 2026-07-21

Assigner: VulnCheck

Description
Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assistant process as root and the subsequent regular-file entry is written through the unvalidated symlink, attackers can achieve remote code execution by overwriting auto-imported Python paths such as site-packages/sitecustomize.py or custom component directories.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-21
Last Modified
2026-07-21
Generated
2026-07-21
AI Q&A
2026-07-21
EPSS Evaluated
N/A
NVD
CVE-2026-64824
EUVD
EUVD-2026-46300

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
home_assistant core to 2026.6.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a path traversal issue in Home Assistant Core before version 2026.6.0. Attackers can exploit it by crafting a tar archive with a symlink entry that has an absolute linkname pointing outside the intended extraction directory. Since the official Docker image runs Home Assistant as root, attackers can write files to arbitrary filesystem paths, leading to remote code execution by overwriting critical Python paths or custom component directories.

Detection Guidance

Check Home Assistant Core version with command: docker exec <container_name> hass --version. If version is before 2026.6.0, the system is vulnerable. Inspect backup files for malicious tar archives by examining symlink entries using tar -tvf <backup_file.tar> and look for absolute paths or suspicious linknames.

Impact Analysis

If you use Home Assistant Core before 2026.6.0, an attacker could exploit this to gain remote code execution on your system. This could allow them to take control of your Home Assistant instance, access sensitive data, or manipulate your smart home devices. The impact is severe because the official Docker image runs as root, giving attackers full system access.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR and HIPAA requirements for data protection and confidentiality. If exploited, it may result in data breaches, unauthorized modifications, or loss of sensitive information, potentially leading to legal penalties and compliance failures.

Mitigation Strategies

Upgrade Home Assistant Core to version 2026.6.0 or later immediately. If using Docker, pull the latest image and restart the container. Avoid restoring backups from untrusted sources. Monitor for unauthorized file writes or changes in system directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart