CVE-2026-32637: Velero vulnerable to file path traversal when extracting from backup's tarball

Severity: medium (CVSS 5.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-25 · updated 2026-09-09
Weakness: CWE-22

Description

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

Affected products

velero-io velero: before 1.18.1

References

https://github.com/securego/gosec/issues/324
https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0
https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c
https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6

Get alerted when CVE-2026-32637 or the next vulnerability affects your stack