VDB
CVE-2026-32637
CVE-2026-32637
PUBLISHED
CVSS 5.900000095367432 MEDIUM
Velero vulnerable to file path traversal when extracting from backup's tarball
EPSS 0.54% · 45.6th percentile
Risk Scores
CVSS 4.0
5.900000095367432
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS Score
0.54%
45.6th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| velero-io | velero | 0 |
| chainguard | velero-plugin-for-alicloud-fips | 0 |
| chainguard | velero-plugin-for-microsoft-azure | 0 |
| chainguard | velero-plugin-for-gcp | 0 |
| chainguard | velero-plugin-for-aws-fips | 0 |
| chainguard | velero-plugin-for-microsoft-azure-fips | 0 |
| github.com | vmware-tanzu/velero | 0 |
| chainguard | velero-plugin-for-alicloud | 0 |
| chainguard | velero-plugin-for-gcp-fips | 0 |
| wolfi | velero-plugin-for-microsoft-azure | 0 |
| chainguard | velero-plugin-for-aws | 0 |
| wolfi | velero-plugin-for-aws | 0 |
Timeline
- Aug 20, 2026 CVE Published
- Aug 26, 2026 EPSS Score
- Aug 30, 2026 EPSS Score
- Sep 2, 2026 Security Advisory
- Sep 3, 2026 EPSS Score
- Sep 6, 2026 EPSS Score
- Sep 9, 2026 EPSS Score
- Sep 12, 2026 EPSS Score
- Sep 16, 2026 EPSS Score
- Sep 18, 2026 EPSS Score
- Sep 21, 2026 EPSS Score
- Sep 22, 2026 EPSS Score
References
- https://github.com/velero-io/velero/commit/3f8e3588496391979915ace065f732a9013c1cf0 url
- https://github.com/velero-io/velero/commit/c7fa4bfe3571667e9731f3f504da3c6be709a24c url
- https://nvd.nist.gov/vuln/detail/CVE-2026-32637 advisory
- https://github.com/advisories/GHSA-j2g6-362q-6qc6 advisory
- https://github.com/velero-io/velero/security/advisories/GHSA-j2g6-362q-6qc6 url
- https://github.com/securego/gosec/issues/324 url