Bug 2567821 (CVE-2026-62268)

Summary: CVE-2026-62268 borgbackup: borgbackup: Arbitrary file overwrite via path traversal during archive extraction
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedKeywords: Security
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in borgbackup. This flaw allows arbitrary file overwrite, deletion, or information disclosure during archive extraction. The application fails to properly validate path targets, allowing symbolic links, directory traversal sequences, and external hard links to escape the target extraction directory. An attacker with access to a backup repository could craft a malicious archive that, when extracted by a user, modifies files outside the destination directory or exposes sensitive local files.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2568097    
Bug Blocks:    

Description OSIDB Bzimport 2026-11-05 22:28:55 UTC 
borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22.