borg extract might modify out-of-tree files when extracting maliciously crafted archives
- Exploited
- No known exploitation
- Fix
- Fixed in 1.4.5, 2.0.0b22
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 1.4.5, 2.0.0b22.
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 5/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
BorgBackup's `borg extract` can be tricked by a maliciously crafted archive into deleting or overwriting files outside the extraction directory, and into hard-linking an attacker-chosen file from outside it into the restored tree, which discloses its contents. The attacker must first have local access with high privileges, such as repository access plus the Borg key and passphrase, and a victim must then extract the archive.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure?/25Unknown. No advisory context yet
- Reach?/20Unknown. No tracked technology or package matched
- Severity5.3/10CVSS 5.3
- No patch0/5No signal
What would change the score
- Would score about 60 if added to CISA KEV
- Would score about 55 if CISA's SSVC rates exploitation active
- Would score about 27 if advisories confirm default setups are exposed
What to do
Upgrade to a fixed version: 1.4.5, 2.0.0b22.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- borgbackup borg
fixed in 1.4.5; From 2.0.0b1 · fixed in 2.0.0b22
Evidence 9
- Advisory
- Repository
- Repository
- Repository
- Repository
Show all 9 sourcesShow fewer sources
- Repository
- Repository
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-62268
Is CVE-2026-62268 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
Which versions are affected by CVE-2026-62268?
borg: before 1.4.5; from 2.0.0b1 before 2.0.0b22.Source: cve.now feed data
How do I fix CVE-2026-62268?
Upgrade to a fixed version: 1.4.5, 2.0.0b22.Source: cve.now feed data