CVE-2026-63120: PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoardrestore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pghoardto a version that resolves this vulnerability.Fixed in 2.7.2
Event History
Frequently Asked Questions
Who is exposed to exploitation?
Deployments running pghoard before version 2.7.2 are exposed when an administrator performs a get-basebackup restore using backup object storage that an attacker can write to. The attacker must be able to place a crafted delta backup manifest in the configured S3, GCS, or Azure backup storage.
Does exploitation require access to the pghoard host or PostgreSQL instance?
No direct host or database access is described as necessary. Exploitation relies on write access to the backup object storage and requires a database administrator to run pghoard_restore get-basebackup on the malicious backup data.
What is the impact of a successful exploit?
A crafted manifest can cause arbitrary file writes and directory creation outside the designated PostgreSQL data directory. The example path targets /etc/cron.d/backdoor, indicating that writes can target host-system locations when permitted by the restore process.
What version fixes the issue?
The issue is patched in pghoard version 2.7.2. Upgrade affected installations before restoring backups from storage that could contain attacker-controlled objects.