Executive brief
Velero, a popular Kubernetes backup and restore tool, fails to properly validate file paths when extracting backup tarballs. An attacker who gains access to the backup storage can upload a malicious tarball with crafted file paths (using directory traversal sequences like "../../../") that cause Velero to write files outside the intended directory, potentially overwriting sensitive system files like SSH keys, Kubernetes configs, or cron jobs on the pod's filesystem.
Technical details
This vulnerability is a classic path traversal (CWE-22) issue in the tarball extraction logic. When Velero restores from a backup, it extracts files from a tarball archive without properly sanitizing file paths. An attacker who compromises or gains write access to the backup's object storage backend (e.g., S3 bucket, Azure Blob Storage) can craft a malicious tarball with embedded path traversal sequences (e.g., "../../../tmp/sensitive_file") in file names. During extraction, these sequences are not stripped, allowing the attacker to write files to arbitrary locations on the Velero pod filesystem. This could enable overwriting critical files such as ~/.ssh/authorized_keys for SSH backdoors, ~/.kube/config for cluster credential theft, or /etc/cron.d/ for persistence via scheduled tasks. The attack requires prior compromise of the backup storage backend but does not require network access to Velero itself. Patches are available in version 1.18.1; no workarounds exist other than securing the backup storage.
Affected products
- VMware Tanzu Velero < 1.18.1
Timeline
- 2026-08-19: disclosed
- 2026-08-20: advisory
- 2026-08-20: patched: Patch released as v1.18.1