Is CVE-2026-62268 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-62268 being exploited in the wild.

How severe is CVE-2026-62268?

Medium severity, with a CVSS score of 4, published 5 November 2026.

Which products and versions are affected?

Borg Backup before 1.4.5; 1.2.x before 1.2-maint branch fixes; 2.0.0 betas before b22; borgbackup (PyPI) < 1.4.5, ECOSYSTEM:introduced=0,fixed=1.4.5.

Am I affected by CVE-2026-62268?

Check whether you run Borg Backup or borgbackup (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-62268: Borg Backup path traversal in extract on malicious archives

Q: Is there a fix for CVE-2026-62268?

Yes. borgbackup (PyPI): upgrade to 1.4.5 or later. Until then: For encrypted or authenticated repositories, do not share the borg key and passphrase with potential attackers. For all repository types, restrict repository access to trusted parties only, typically enforced through SSH keys for remote repositories or physical access controls for local storage. ["local"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-62268 · Severity: medium · CVSS 4 · Published 2026-11-05

Borg Backup, a deduplicating backup and archiving tool, could extract files outside the intended directory when processing specially crafted archives containing symlinks or ".." path components. An attacker with repository access and encryption credentials could overwrite or delete arbitrary files on the system during archive extraction, potentially leading to data loss or system compromise.

Technologies: borgbackup (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2026-62268 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-62268 being exploited in the wild.
How severe is CVE-2026-62268?: Medium severity, with a CVSS score of 4, published 5 November 2026.
Which products and versions are affected?: Borg Backup before 1.4.5; 1.2.x before 1.2-maint branch fixes; 2.0.0 betas before b22; borgbackup (PyPI) < 1.4.5, ECOSYSTEM:introduced=0,fixed=1.4.5.
Is there a fix for CVE-2026-62268?: Yes. borgbackup (PyPI): upgrade to 1.4.5 or later. Until then: For encrypted or authenticated repositories, do not share the borg key and passphrase with potential attackers. For all repository types, restrict repository access to trusted parties only, typically enforced through SSH keys for remote repositories or physical access controls for local storage.</anigation> <parameter name="attack_vector">["local"] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-62268 attacked?: It is in a software library.
Am I affected by CVE-2026-62268?: Check whether you run Borg Backup or borgbackup (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

borgbackup (PyPI): upgrade to 1.4.5 or later
```
pip install "borgbackup>=1.4.5"
```

For encrypted or authenticated repositories, do not share the borg key and passphrase with potential attackers. For all repository types, restrict repository access to trusted parties only, typically enforced through SSH keys for remote repositories or physical access controls for local storage.</anigation> <parameter name="attack_vector">["local"]

Technical details

The vulnerability is a path traversal flaw in the extract operation. Borg failed to properly sanitize symlinks and ".." path components in archive items, as well as hardlink sources that could point outside the extraction directory. An attacker with repository access (and encryption key/passphrase for encrypted repos) could craft a malicious archive to achieve arbitrary file write/delete on the target system during extraction.

Affected products

Borg Backup Borg Backup before 1.4.5; 1.2.x before 1.2-maint branch fixes; 2.0.0 betas before b22

Identifiers

CVE-2026-62268
GHSA-gfp8-w835-v44j

Timeline

2026-10-15: disclosed: Published as GHSA-gfp8-w835-v44j
2026-10-15: patched: Fix released in 1.4.5 and 2.0.0b22

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.