CVE-2026-64825: Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload
Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.truediv to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Home Assistant Coreto a version that resolves this vulnerability.Fixed in 2026.6.0 - Compensating control
Limit/disable the initial onboarding backup upload window so unauthenticated attackers cannot upload a crafted backup archive during onboarding.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64825?
CVE-2026-64825 is rated as critical with a severity score of 9.3.
How do I fix CVE-2026-64825?
To fix CVE-2026-64825, upgrade Home Assistant Core to version 2026.6.0 or later.
What vulnerability type is CVE-2026-64825?
CVE-2026-64825 is a path traversal vulnerability.
Who is affected by CVE-2026-64825?
Users of Home Assistant Core versions before 2026.6.0 are affected by CVE-2026-64825.
What can attackers do with CVE-2026-64825?
Attackers can exploit CVE-2026-64825 to write arbitrary files to any directory on the host filesystem.