Executive brief
Home Assistant Core is a popular open-source home automation platform that runs on users' servers. During initial setup, the application allows file restoration from backup archives. An unauthenticated attacker can craft a malicious backup file and upload it during onboarding to write arbitrary files to any location on the server's filesystem, potentially achieving complete system compromise if the service runs with elevated privileges.
Technical details
This is a path traversal vulnerability (CWE-22) in the backup restoration feature of Home Assistant Core. The vulnerability exists in how the application processes the 'name' field from backup.json during upload. Specifically, pathlib.Path.__truediv__ (the `/` operator for path joining) in Python does not properly validate absolute paths—if the right operand is an absolute path, it discards the left operand entirely, allowing an attacker to bypass the configured backup directory restriction. An unauthenticated attacker can exploit this during the initial onboarding window before authentication is enforced. By crafting a backup archive with a specially-formed absolute path in the 'name' field, an attacker can write files to arbitrary locations on the filesystem. When Home Assistant runs as root (common in containerized deployments), this grants full system compromise. The vulnerability is patched in version 2026.6.0.
Affected products
- Home Assistant Home Assistant Core before 2026.6.0
Timeline
- 2026-07-21: disclosed
- 2026-06-00: patched: Fixed in version 2026.6.0