CVE-2026-61625

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61625
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61625.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-61625
Aliases
Downstream
Published
2026-08-20T16:45:43Z
Modified
2026-09-20T11:47:12Z
Severity
  • 6.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N CVSS Calculator
Summary
VictoriaMetrics vmrestore: path traversal via crafted backup part names escapes restore root
Details

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61625.json"
}
References

Affected packages

Git / github.com/victoriametrics/victoriametrics

Affected ranges

Type
GIT
Repo
https://github.com/victoriametrics/victoriametrics
Events
Introduced
bf50dcecfbdf57ab5bd3f470894abf575b3d2f56
Introduced
9287ab8ff89939985576adea4c422a7f4061acac
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e8cfb1e17236a7df5770fce768e29e48f1ccf49a
Fixed
80d1104fcad3635ee62bd8d8f2024215b0771a16
Fixed
80d1104fcad3635ee62bd8d8f2024215b0771a16
Fixed
710c920d6083327042a309e449fae4383617d817
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "1.137.0"
        },
        {
            "fixed": "1.146.0"
        },
        {
            "introduced": "1.123.0"
        },
        {
            "fixed": "1.136.12"
        },
        {
            "introduced": "0"
        },
        {
            "fixed": "1.122.25"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v0.*
v0.1.0-victorialogs
v0.10.0-victorialogs
v0.11.0-victorialogs
v0.12.0-victorialogs
v0.12.1-victorialogs
v0.13.0-victorialogs
v0.14.0-victorialogs
v0.15.0-victorialogs
v0.16.0-victorialogs
v0.17.0-victorialogs
v0.18.0-victorialogs
v0.19.0-victorialogs
v0.2.0-victorialogs
v0.20.0-victorialogs
v0.20.1-victorialogs
v0.20.2-victorialogs
v0.21.0-victorialogs
v0.22.0-victorialogs
v0.23.0-victorialogs
v0.24.0-victorialogs
v0.25.0-victorialogs
v0.26.0-victorialogs
v0.26.1-victorialogs
v0.27.0-victorialogs
v0.27.1-victorialogs
v0.28.0-victorialogs
v0.29.0-victorialogs
v0.3.0-victorialogs
v0.30.0-victorialogs
v0.30.1-victorialogs
v0.31.0-victorialogs
v0.32.0-victorialogs
v0.32.1-victorialogs
v0.33.0-victorialogs
v0.34.0-victorialogs
v0.35.0-victorialogs
v0.36.0-victorialogs
v0.37.0-victorialogs
v0.38.0-victorialogs
v0.39.0-victorialogs
v0.4.0-victorialogs
v0.4.2-victorialogs
v0.40.0-victorialogs
v0.41.0-victorialogs
v0.42.0-victorialogs
v0.5.0-victorialogs
v0.5.1-victorialogs
v0.5.2-victorialogs
v0.6.0-victorialogs
v0.6.1-victorialogs
v0.7.0-victorialogs
v0.8.0-victorialogs
v0.9.0-victorialogs
v0.9.1-victorialogs
v1.*
v1.0.0-victorialogs
v1.1.0-victorialogs
v1.10.0
v1.10.0-victorialogs
v1.10.1
v1.10.1-victorialogs
v1.100.0
v1.100.1
v1.101.0
v1.102.0
v1.102.0-rc1
v1.102.0-rc2
v1.102.1
v1.102.10
v1.102.11
v1.102.12
v1.102.13
v1.102.14
v1.102.15
v1.102.16
v1.102.17
v1.102.18
v1.102.19
v1.102.2
v1.102.20
v1.102.21
v1.102.22
v1.102.23
v1.102.24
v1.102.25
v1.102.26
v1.102.3
v1.102.4
v1.102.5
v1.102.6
v1.102.7
v1.102.8
v1.102.9
v1.103.0
v1.104.0
v1.105.0
v1.106.0
v1.106.1
v1.108.1
v1.109.0
v1.109.1
v1.11.0
v1.11.0-victorialogs
v1.11.1
v1.11.2
v1.11.3
v1.11.4
v1.110.1
v1.110.10
v1.110.11
v1.110.12
v1.110.13
v1.110.14
v1.110.15
v1.110.16
v1.110.17
v1.110.18
v1.110.19
v1.110.2
v1.110.20
v1.110.21
v1.110.22
v1.110.23
v1.110.24
v1.110.25
v1.110.26
v1.110.27
v1.110.28
v1.110.29
v1.110.3
v1.110.30
v1.110.31
v1.110.4
v1.110.5
v1.110.6
v1.110.7
v1.110.8
v1.110.9
v1.111.0
v1.113.0
v1.114.0
v1.115.0
v1.117.0
v1.117.1
v1.118.0
v1.119.0
v1.12.0
v1.12.0-victorialogs
v1.12.1
v1.12.2
v1.12.3
v1.12.4
v1.12.5
v1.12.6
v1.120.0
v1.121.0
v1.122.0
v1.122.1
v1.122.10
v1.122.11
v1.122.12
v1.122.13
v1.122.14
v1.122.15
v1.122.16
v1.122.17
v1.122.18
v1.122.19
v1.122.2
v1.122.20
v1.122.21
v1.122.22
v1.122.23
v1.122.24
v1.122.3
v1.122.4
v1.122.5
v1.122.6
v1.122.7
v1.122.8
v1.122.9
v1.123.0
v1.124.0
v1.125.0
v1.125.1
v1.126.0
v1.127.0
v1.128.0
v1.129.0
v1.129.1
v1.13.0
v1.13.0-victorialogs
v1.13.1
v1.130.0
v1.131.0
v1.132.0
v1.133.0
v1.134.0
v1.135.0
v1.136.0
v1.136.1
v1.136.10
v1.136.11
v1.136.16
v1.136.17
v1.136.18
v1.136.2
v1.136.3
v1.136.4
v1.136.5
v1.136.6
v1.136.7
v1.136.8
v1.136.9
v1.137.0
v1.137.0-cluster
v1.138.0
v1.138.0-cluster
v1.139.0
v1.139.0-cluster
v1.14.0
v1.14.0-victorialogs
v1.14.1
v1.14.2
v1.140.0
v1.140.0-cluster
v1.141.0
v1.141.0-cluster
v1.142.0
v1.142.0-cluster
v1.143.0
v1.143.0-cluster
v1.144.0
v1.144.0-cluster
v1.145.0
v1.145.0-cluster
v1.146.0
v1.15.0
v1.15.0-victorialogs
v1.15.1
v1.15.2
v1.16.0
v1.16.0-victorialogs
v1.17.0
v1.17.0-victorialogs
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.18.0
v1.18.0-victorialogs
v1.18.1
v1.18.10
v1.18.11
v1.18.3
v1.18.4
v1.18.5
v1.18.6
v1.18.7
v1.18.8
v1.18.9
v1.19.0
v1.19.0-victorialogs
v1.19.1
v1.19.2
v1.19.3
v1.19.4
v1.2.0-victorialogs
v1.2.1
v1.20.0
v1.20.0-victorialogs
v1.20.1
v1.20.2
v1.20.3
v1.20.4
v1.20.5
v1.20.6
v1.20.7
v1.21.0
v1.21.0-victorialogs
v1.21.1
v1.21.2
v1.22.0
v1.22.0-victorialogs
v1.22.1
v1.22.1-victorialogs
v1.22.2
v1.22.2-victorialogs
v1.23.0
v1.23.0-victorialogs
v1.23.1
v1.23.1-victorialogs
v1.23.2-victorialogs
v1.23.3-victorialogs
v1.24.0
v1.24.0-victorialogs
v1.24.1
v1.25.0
v1.25.1
v1.25.2
v1.26.0
v1.27.0
v1.27.1
v1.27.2
v1.27.3
v1.28.0
v1.28.0-beta1
v1.28.0-beta2
v1.28.0-beta3
v1.28.0-beta4
v1.28.0-beta5
v1.28.0-beta6
v1.28.1
v1.28.2
v1.28.3
v1.29.0
v1.29.1
v1.29.2
v1.29.3
v1.29.4
v1.29.5
v1.3.0
v1.3.0-victorialogs
v1.3.1
v1.3.1-victorialogs
v1.3.2
v1.3.2-victorialogs
v1.30.0
v1.30.1
v1.30.2
v1.30.3
v1.30.4
v1.30.5
v1.30.6
v1.31.0
v1.31.1
v1.31.2
v1.31.3
v1.31.4
v1.31.5
v1.32.0
v1.32.1
v1.32.2
v1.32.3
v1.32.4
v1.32.5
v1.32.6
v1.32.7
v1.32.8
v1.33.0
v1.33.1
v1.34.0
v1.34.1
v1.34.2
v1.34.3
v1.34.4
v1.34.5
v1.34.6
v1.34.7
v1.34.8
v1.34.9
v1.35.0
v1.35.1
v1.35.2
v1.35.3
v1.35.4
v1.35.5
v1.35.6
v1.36.0
v1.36.1
v1.36.2
v1.36.3
v1.37.0
v1.37.1
v1.37.2
v1.37.3
v1.37.4
v1.38.0
v1.38.1
v1.39.0
v1.39.1
v1.39.2
v1.39.3
v1.39.4
v1.4.0
v1.4.0-victorialogs
v1.40.0
v1.40.1
v1.41.0
v1.41.1
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.47.0
v1.48.0
v1.49.0
v1.5.0
v1.5.0-victorialogs
v1.5.1
v1.50.0
v1.50.1
v1.50.2
v1.51.0
v1.52.0
v1.53.0
v1.54.0
v1.54.1
v1.55.0
v1.55.1
v1.56.0
v1.57.0
v1.57.1
v1.58.0
v1.59.0
v1.6.0
v1.6.0-victorialogs
v1.6.1
v1.6.1-victorialogs
v1.6.2
v1.60.0
v1.61.0
v1.61.1
v1.62.0
v1.63.0
v1.64.0
v1.64.1
v1.65.0
v1.66.0
v1.66.1
v1.66.2
v1.67.0
v1.68.0
v1.69.0
v1.7.0
v1.7.0-victorialogs
v1.7.1
v1.7.2
v1.7.3
v1.7.4
v1.7.5
v1.7.6
v1.70.0
v1.71.0
v1.72.0
v1.73.0
v1.73.1
v1.74.0
v1.75.0
v1.76.0
v1.76.1
v1.77.0
v1.77.1
v1.77.2
v1.78.0
v1.79.0
v1.8.0
v1.8.0-victorialogs
v1.8.1
v1.8.2
v1.80.0
v1.81.0
v1.81.1
v1.82.0
v1.83.0
v1.83.1
v1.84.0
v1.85.0
v1.85.1
v1.85.2
v1.85.3
v1.86.0
v1.86.1
v1.86.2
v1.87.0
v1.87.1
v1.88.0
v1.88.1
v1.89.0
v1.89.1
v1.9.0
v1.9.0-victorialogs
v1.9.1-victorialogs
v1.90.0
v1.91.0
v1.91.1
v1.91.2
v1.92.0
v1.92.1
v1.93.0
v1.94.0
v1.95.0
v1.95.1
v1.96.0
v1.97.0
v1.97.1
v1.97.10
v1.97.11
v1.97.12
v1.97.13
v1.97.14
v1.97.15
v1.97.16
v1.97.17
v1.97.2
v1.97.3
v1.97.4
v1.97.5
v1.97.6
v1.97.7
v1.97.8
v1.97.9
v1.98.0
v1.99.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-61625.json"