DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-61625: CVE-2026-61625: Arbitrary File Write via Path Traversal in VictoriaMetrics vmrestore

#security #cve #cybersecurity

CVE-2026-61625: Arbitrary File Write via Path Traversal in VictoriaMetrics vmrestore

Vulnerability ID: CVE-2026-61625
CVSS Score: 6.8
Published: 2026-09-03

CVE-2026-61625 is a path traversal vulnerability (CWE-22) within the vmrestore utility of VictoriaMetrics. When restoring database shards from a compromised or malicious backup source, the application fails to validate the paths of backup parts before creating and writing files. By injecting objects with directory traversal sequences (such as ../) into the remote backup storage, an attacker can write arbitrary files to out-of-bounds locations on the system executing the restore operation. Depending on the process privileges, this can result in host compromise via remote code execution.

TL;DR

A directory traversal flaw in the VictoriaMetrics vmrestore utility enables attackers with write access to the backup store to execute arbitrary file writes on the restoration host, which can lead to remote code execution.

Technical Details

  • CWE ID: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory)
  • Attack Vector: Network
  • CVSS v3.1 Score: 6.8 (Medium)
  • EPSS Score: 0.00303 (0.30% probability of active exploitation in 30 days)
  • Exploit Status: None (No public functional exploits available)
  • CISA KEV Status: Not Listed
  • Impact: Arbitrary File Write / Remote Code Execution

Affected Systems

  • VictoriaMetrics vmrestore
  • VictoriaMetrics backup-restore workflows
  • VictoriaMetrics: < 1.122.25 (Fixed in: 1.122.25)
  • VictoriaMetrics: >= 1.123.0, < 1.136.12 (Fixed in: 1.136.12)
  • VictoriaMetrics: >= 1.137.0, < 1.146.0 (Fixed in: 1.146.0)

Code Analysis

Commit: 710c920

BUGFIX: vmrestore: disallow restoring parts outside the configured -storageDataPath directory.

Mitigation Strategies

  • Restrict write and modification access to remote backup stores (S3, GCS, Azure Blob) using strict IAM policies.
  • Scan remote backup object keys for the presence of relative path sequences (such as '../') before invoking the restoration utility.
  • Upgrade VictoriaMetrics vmrestore to patched releases immediately.

Remediation Steps:

  1. Identify all deployment instances of the vmrestore binary in automated pipelines or operator environments.
  2. Update the binary to version 1.122.25, 1.136.12, or 1.146.0 or newer.
  3. Verify the upgrade by reviewing the version output and checking compatibility logs.
  4. Implement AWS S3 or bucket-level access control restrictions to enforce read-only credentials for restoration tasks.

References

Read the full report for CVE-2026-61625 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)