CVE-2026-32637

Deferred Deferred - Pending Action

Path Traversal in Velero Backup Tool

Publication date: 2026-08-25

Last updated on: 2026-09-09

Assigner: GitHub, Inc.

Description

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-09-09

Generated

2026-09-15

AI Q&A

2026-08-26

EPSS Evaluated

2026-09-13

NVD

CVE-2026-32637

Affected Vendors & Products

Vendor	Product	Version / Range
vmware	velero	1.18.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

This vulnerability affects Velero, a Kubernetes backup tool. An attacker who gains access to the backup storage can upload a malicious backup file that contains paths escaping the intended extraction directory during restoration. This allows overwriting sensitive files in the Velero pod filesystem.

Detection Guidance

Detecting this vulnerability requires checking the Velero version in use. Run 'velero version' to verify if the installed version is below 1.18.1. Additionally, inspect backup tarballs for parent-directory paths that could escape extraction directories during restore.

Impact Analysis

If exploited, this vulnerability could allow an attacker to overwrite critical files in the Velero pod, potentially leading to unauthorized access, data corruption, or disruption of backup and restore operations in a Kubernetes cluster.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing an attacker to overwrite sensitive files in the Velero pod filesystem. If exploited, it may lead to unauthorized access or modification of personal or health data, violating confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Velero to version 1.18.1 or later immediately. Ensure backup tarballs are validated for malicious parent-directory paths before restoration. Restrict access to the backup object-storage backend to trusted users only.

Hi! I’m here to help you understand CVE-2026-32637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70