Description

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-20T17:18:51.783Z",
  "pubdate": "2026-08-20T17:18:51.783Z",
  "executiveSummary": "This vulnerability is a path traversal flaw residing in the vmrestore component of VictoriaMetrics. The issue allows an attacker capable of supplying or modifying a backup source (such as S3, GCS, or Azure Blob Storage) to inject directory traversal sequences into backup object names. When an operator executes a restore operation, the software fails to validate backup part path components, causing restored data to be written outside the intended storageDataPath directory. This flaw compromises the integrity and confidentiality of the host filesystem within the execution permissions of the vmrestore process. Successful exploitation requires the attacker to have write or modification access to the external backup storage source prior to the restore operation initiated by an operator. The vulnerability affects VictoriaMetrics prior to versions 1.122.25, 1.136.12, and 1.146.0, where it has been officially remediated.",
  "technicalDetails": "The root cause of the vulnerability lies in the insufficient validation of backup part path components within vmrestore before handling file write operations via lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go. The application processes object names directly from the backup source without sanitizing or checking for relative path traversal sequences, specifically dot-dot (..) components.\nThe attack vector involves an authenticated entity with access to the external object storage (including S3, Google Cloud Storage, or Azure Blob Storage) provisioning malicious or modified backup archives. Within these archives, object names are crafted to contain directory traversal patterns. When a system operator subsequently invokes the vmrestore utility against this compromised backup source, the application iterates through the objects and attempts to write the restored data onto the local filesystem beneath the configured storageDataPath.\nBecause path validation is absent, the presence of traversal sequences in the object names forces the file writing routines to navigate upward in the directory tree relative to the intended base path. This payload behavior results in the creation, truncation, or overwriting of arbitrary files across the filesystem, restricted only by the operational privileges and file system permissions assigned to the running vmrestore process. The affected components comprise the backup restoration execution flow in lib/backup/actions/restore.go and the local filesystem interaction layer in lib/backup/fslocal/fslocal.go. Affected product versions include all VictoriaMetrics releases prior to 1.122.25, 1.136.12, and 1.146.0."
}