CVE-2026-61625
Received Received - Intake

Path Traversal in VictoriaMetrics vmrestore

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: GitHub, Inc.

Description
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-61625
EUVD
EUVD-2026-63474

Affected Vendors & Products

Showing 10 associated CPEs
Vendor Product Version / Range
victoriametrics vmrestore to 1.122.25 (inc)
victoriametrics vmrestore to 1.136.12 (inc)
victoriametrics vmrestore to 1.146.0 (inc)
victoriametrics vmrestore 1.122.25
victoriametrics vmrestore 1.136.12
victoriametrics vmrestore 1.146.0
victoriametrics vmrestore From 1.122.25|end_including=1.122.25 (exc)
victoriametrics vmrestore From 1.136.12|end_including=1.136.12 (exc)
victoriametrics vmrestore From 1.137.0|end_excluding=1.146.0 (exc)
victoriametrics vmrestore From 1.123.0|end_excluding=1.136.12 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects VictoriaMetrics' vmrestore tool. Before versions 1.122.25, 1.136.12, and 1.146.0, vmrestore fails to validate backup part paths during restoration. An attacker with access to backup sources like S3 or Azure Blob Storage can craft object names with .. components to write files outside the intended restore directory. This could allow overwriting or creating files within the filesystem permissions of the vmrestore process.

Detection Guidance

Check the version of VictoriaMetrics vmrestore installed on your system. If it is below 1.122.25, 1.136.12, or 1.146.0, the system is vulnerable. Run: vmrestore --version to verify the installed version.

Impact Analysis

If you use affected VictoriaMetrics versions, an attacker could exploit this to overwrite critical system files, modify configurations, or plant malicious files. This could lead to denial of service, privilege escalation, or further compromise of your system. The impact depends on the permissions of the vmrestore process.

Compliance Impact

This vulnerability could violate compliance requirements by enabling unauthorized file access or modification. For GDPR, it may risk data integrity or unauthorized access to personal data. For HIPAA, it could compromise protected health information integrity. Organizations must ensure patched versions are deployed to maintain compliance.

Mitigation Strategies

Upgrade VictoriaMetrics vmrestore to version 1.122.25, 1.136.12, or 1.146.0 or later immediately. Avoid restoring untrusted backup sources until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-61625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart