Symlink Path Traversal Vulnerability in BorgBackup Archive Extraction

CVE-2026-62268

What is CVE-2026-62268?

BorgBackup, an open-source deduplicating archiver, is susceptible to a vulnerability in its archive extraction process. Specifically, versions prior to 1.4.5 and 2.0.0b22 allow attackers to exploit symlinked paths and embedded dot-dot components, which can lead to the deletion or overwriting of files outside of the designated extraction directory. Additionally, the vulnerability can enable an attacker to create a malicious archive that uses a crafted hardlink to expose sensitive files located outside of the extraction directory, contingent on having repository access and decrypting the archived contents. This issue has been addressed in the latest releases.

References