Summary
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root
The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside the intended -storageDataPath restore root, subject to the permissions of the vmrestore process.
Resources
Note
VictoriaMetrics' security model assumes backup sources are trusted and access-controlled. This vulnerability requires an attacker to have write access to the backup storage (e.g. S3, GCS, or Azure Blob Storage bucket) used as the -src for vmrestore. Under a correctly secured deployment where backup storage access is properly restricted, unauthorized exploitation of this issue should not be possible. Users are advised to follow the principle of least privilege when granting access to backup storage buckets.
Impact
An attacker who can supply or modify the backup source -- for example by writing malicious object names to a compromised or misconfigured storage bucket -- can cause arbitrary files to be created or overwritten on the host running vmrestore, within the limits of the process's filesystem permissions.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
CVE-2026-61625 has a CVSS score of 6.8 (Medium). The vector is network-reachable, low privileges required, and user interaction required. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (1.146.0, 1.136.12, 1.122.25); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Versions 1.146.0, 1.136.12, 1.122.25
Frequently Asked Questions
- What is CVE-2026-61625? CVE-2026-61625 is a medium-severity path traversal vulnerability in github.com/VictoriaMetrics/VictoriaMetrics (go), affecting versions >= 1.137.0, < 1.146.0. It is fixed in 1.146.0, 1.136.12, 1.122.25. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- How severe is CVE-2026-61625? CVE-2026-61625 has a CVSS score of 6.8 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of github.com/VictoriaMetrics/VictoriaMetrics are affected by CVE-2026-61625? github.com/VictoriaMetrics/VictoriaMetrics (go) versions >= 1.137.0, < 1.146.0 is affected.
- Is there a fix for CVE-2026-61625? Yes. CVE-2026-61625 is fixed in 1.146.0, 1.136.12, 1.122.25. Upgrade to this version or later.
- Is CVE-2026-61625 exploitable, and should I be worried? Whether CVE-2026-61625 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-61625 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-61625?
- Upgrade
github.com/VictoriaMetrics/VictoriaMetricsto 1.146.0 or later - Upgrade
github.com/VictoriaMetrics/VictoriaMetricsto 1.136.12 or later - Upgrade
github.com/VictoriaMetrics/VictoriaMetricsto 1.122.25 or later
- Upgrade