Is CVE-2026-64825 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-64825 being exploited in the wild.

How severe is CVE-2026-64825?

Critical severity, with a CVSS score of 9.3, published 21 July 2026.

Which products and versions are affected?

Home Assistant Core before 2026.6.0; homeassistant (PyPI) < 2026.6.0, ECOSYSTEM:introduced=0,fixed=2026.6.0.

Is there a fix for CVE-2026-64825?

Yes. homeassistant (PyPI): upgrade to 2026.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-64825 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-64825?

Check whether you run Home Assistant Core or homeassistant (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64825: Home Assistant Core path traversal in backup upload

Q: Is there a fix for CVE-2026-64825?

Yes. homeassistant (PyPI): upgrade to 2026.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-64825 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-64825?

Check whether you run Home Assistant Core or homeassistant (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-64825 · Severity: critical · CVSS 9.3 · Published 2026-07-21

Home Assistant Core is a popular open-source home automation platform that runs on users' servers. During initial setup, the application allows file restoration from backup archives. An unauthenticated attacker can craft a malicious backup file and upload it during onboarding to write arbitrary files to any location on the server's filesystem, potentially achieving complete system compromise if the service runs with elevated privileges.

Technologies: Home Assistant Core, homeassistant (PyPI). Vendors: Home Assistant, PyPI.

Quick answers

Is CVE-2026-64825 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-64825 being exploited in the wild.
How severe is CVE-2026-64825?: Critical severity, with a CVSS score of 9.3, published 21 July 2026.
Which products and versions are affected?: Home Assistant Core before 2026.6.0; homeassistant (PyPI) < 2026.6.0, ECOSYSTEM:introduced=0,fixed=2026.6.0.
Is there a fix for CVE-2026-64825?: Yes. homeassistant (PyPI): upgrade to 2026.6.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-64825 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-64825?: Check whether you run Home Assistant Core or homeassistant (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

homeassistant (PyPI): upgrade to 2026.6.0 or later
```
pip install "homeassistant>=2026.6.0"
```

Technical details

This is a path traversal vulnerability (CWE-22) in the backup restoration feature of Home Assistant Core. The vulnerability exists in how the application processes the 'name' field from backup.json during upload. Specifically, pathlib.Path.__truediv__ (the `/` operator for path joining) in Python does not properly validate absolute paths—if the right operand is an absolute path, it discards the left operand entirely, allowing an attacker to bypass the configured backup directory restriction. An unauthenticated attacker can exploit this during the initial onboarding window before authentication is enforced. By crafting a backup archive with a specially-formed absolute path in the 'name' field, an attacker can write files to arbitrary locations on the filesystem. When Home Assistant runs as root (common in containerized deployments), this grants full system compromise. The vulnerability is patched in version 2026.6.0.

Affected products

Home Assistant Home Assistant Core before 2026.6.0

Identifiers

CVE-2026-64825
GHSA-5hxg-r395-fqxx
PYSEC-2026-3669

Timeline

2026-07-21: disclosed
2026-06-00: patched: Fixed in version 2026.6.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.