CVE-2026-67449 Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key

Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler app/api/tus/hooks/route.ts allowed an unauthenticated attacker to...

CVE-2026-67449

The database backup and restore tool Portabase is vulnerable to an unauthenticated path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) in versions prior to 1.21.2 . An attacker can exploit this flaw to overwrite arbitrary files within the private data directory, specific...