Executive brief
VictoriaMetrics vmrestore is a utility used to restore databases from backup sources such as cloud storage buckets. The tool fails to properly validate file paths in backup data, allowing an attacker with write access to the backup storage to craft malicious backup object names containing path traversal sequences (e.g., `..`) that cause files to be written outside the intended restore directory. This can result in arbitrary files being created or overwritten on the host system.
Technical details
The vmrestore utility contains a path traversal vulnerability (CWE-22) caused by insufficient validation of backup part path components before writing restored files to the filesystem. An attacker who can write to the backup source—such as an S3, Google Cloud Storage, or Azure Blob Storage bucket configured as the `-src` for vmrestore—can craft object names with `..` sequences that escape the intended `-storageDataPath` restore root directory. The attack requires write access to backup storage and user interaction to trigger the restore operation. An attacker exploiting this can create or overwrite arbitrary files within the filesystem permissions of the vmrestore process. Patches are available in versions 1.146.0, 1.136.12, and 1.122.25.
Affected products
- VictoriaMetrics VictoriaMetrics >=1.137.0, <1.146.0; >=1.123.0, <1.136.12; <1.122.25
Timeline
- 2026-09-03: disclosed
- 2026-09-03: patched: Patches released in versions 1.146.0, 1.136.12, and 1.122.25