Exploit for CVE-2026-64824

CVE-2026-64824 — Home Assistant Core Backup-Restore Symlink Pa...

homeassistant-stubs (>=2026.5.0b0, <=2026.6.4), pytest-homeassistant-custom-component (>=0.13.326, <=0.13.340) +1 more potentially affected by CVE-2026-64824 via homeassistant (>=2026.5.0b0, <=2026.6.4)

homeassistant PYPI version =2026.5.0b0, =2026.5.0b0, =0.13.326, =1.0.15, =1.0.29 Source cves: CVE-2026-64824 Source advisory: SNYK:PYTHON-HOMEASSISTANT-18508061...

CVE-2026-64824 Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute...