CVE-2026-61625: VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
VictoriaMetrics vmrestoreto a version that resolves this vulnerability.Fixed in 1.122.25 - Upgrade
Upgrade
VictoriaMetrics vmrestoreto a version that resolves this vulnerability.Fixed in 1.136.12 - Upgrade
Upgrade
VictoriaMetrics vmrestoreto a version that resolves this vulnerability.Fixed in 1.146.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using vmrestore to restore backups from an S3, GCS, Azure Blob Storage, or other backup source are exposed if an attacker can supply or modify that source. The impact is limited to files the vmrestore process has permission to create or overwrite.
What interaction is required for exploitation?
An attacker needs the ability to place crafted backup object names containing .. path components in the backup source. An operator must then run vmrestore against that source.
Are default restore operations affected?
The issue affects restore operations that process a maliciously supplied or modified backup source; the provided information does not indicate that a trusted, unmodified backup source alone triggers it.
What should be done if upgrading cannot happen immediately?
Do not restore from backup sources that untrusted parties can supply or modify, and restrict write access to backup storage. Run vmrestore with filesystem permissions limited to the intended restore area so that any escaped writes have minimal impact.
How can teams determine whether they are affected?
Check the vmrestore version in use. Versions before 1.122.25, 1.136.12, and 1.146.0 are affected; the issue is fixed in those versions.