VDB

CVE-2026-32637

CVE-2026-32637 PUBLISHED CVSS 5.9 MEDIUM

Reported by GitHub_M · Published August 25, 2026

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

Risk Scores

CVSS 4.0
5.9
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

Affected Products

VendorProductVersions
velero-iovelero< 1.18.1
velero-iovelero0
chainguardvelero-plugin-for-alicloud-fips0
chainguardvelero-plugin-for-microsoft-azure0
chainguardvelero-plugin-for-gcp0
chainguardvelero-plugin-for-aws-fips0
chainguardvelero-plugin-for-microsoft-azure-fips0
github.comvmware-tanzu/velero0
chainguardvelero-plugin-for-alicloud0
chainguardvelero-plugin-for-gcp-fips0
wolfivelero-plugin-for-microsoft-azure0
chainguardvelero-plugin-for-aws0
wolfivelero-plugin-for-aws0

Timeline

  • Aug 20, 2026 CVE Published
  • Aug 26, 2026 EPSS Score
  • Aug 28, 2026 CVE Updated
  • Aug 30, 2026 EPSS Score
  • Sep 2, 2026 Security Advisory
  • Sep 3, 2026 EPSS Score
  • Sep 6, 2026 EPSS Score
  • Sep 9, 2026 EPSS Score
  • Sep 12, 2026 EPSS Score
  • Sep 16, 2026 EPSS Score
  • Sep 18, 2026 EPSS Score
  • Sep 21, 2026 EPSS Score

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›