Path Traversal Vulnerability in Kopia from Lenses Software

CVE-2026-124029

What is CVE-2026-124029?

Kopia, a backup and backup restoration tool, contains a vulnerability whereby users with repository write access can exploit crafted entry names to escape the restore directory. Specifically, through the copyDirectoryContent function, attackers can manipulate directory manifest entries with names like '..', facilitating unauthorized access to write malicious content outside the secure restore directory. This allows for potential data compromise upon restoration with default settings, posing a significant risk to user data integrity and confidentiality.

References