Path Traversal Vulnerability in Portabase Database Backup Tool
CVE-2026-67449

9.8CRITICAL

Key Information:

Vendor

Portabase

Status
Portabase
Vendor
CVE Published:
11 November 2026

What is CVE-2026-67449?

Portabase, a versatile database backup and restore tool, contains a path traversal vulnerability in its TUS upload webhook handler that allows unauthenticated attackers to overwrite arbitrary files within the private data directory. This includes critical files such as the AES-256-GCM master key stored in /data/private/keys/master_key.bin. This vulnerability has been addressed in version 1.21.2, ensuring enhanced security for users.

Affected Version(s)

portabase < 1.21.2

References

https://github.com/Portabase/portabase/security/advisorie...
x_refsource_CONFIRM
https://github.com/Portabase/portabase/pull/355
x_refsource_MISC
https://github.com/Portabase/portabase/commit/8dcb4067907...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.