CVE-2026-32637 — Velero vulnerable to file path traversal when extracting from backup's tarball
Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the back…
Published: 2026-08-25 · CVSS: 5.9 · CVSS 4.0
Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7