532 matches found
EUVD-2026-64143
Runtipi is a personal homeserver orchestrator. In 4.10.0 and earlier, Runtipi accepts symbolic links from an attacker-controlled backup archive and copies them into live application paths during the backup restore flow. An authenticated attacker can plant user-config/app.env as a symlink to an...
CVE-2026-55168
Runtipi (personal homeserver orchestrator) versions 4.10.0 and earlier are vulnerable to an authenticated arbitrary file write via symlink planting during the backup restore flow. An attacker with valid credentials can craft a backup archive containing a symlink (e.g., user-config/app.env pointin...
Emlog 2.1.9 - SQL Injection
emlog v2.1.9 contains a SQL injection caused by unsanitized input in the data backup/restore functionality, allowing attackers to execute arbitrary SQL commands through crafted backup files. id: CVE-2023-39121 info: name: Emlog 2.1.9 - SQL Injection author: wjch611 severity: high description: |...
NocoBase backup restore schema name allows command injection
Summary NocoBase @nocobase/plugin-backups 2.0.57 restores PostgreSQL backups by interpolating the backup metadata schema name into shell command strings that are executed with Node.js childprocess.exec. A backup-management user who can restore an uploaded PostgreSQL backup with forced schema...
GHSA-J2G6-362Q-6QC6 Velero vulnerable to file path traversal when extracting from backup's tarball
Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...
Velero vulnerable to file path traversal when extracting from backup's tarball
Impact What kind of vulnerability is it? Who is impacted? If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: ../../../tmp/escape1 - file created at /tmp/escape1 ../../../../../../../../tmp/escape2 - file...
EUVD-2026-63474
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below...
CVE-2026-76635
baserCMS before 5.3.0 is vulnerable in BcDatabaseService.php, where authenticated administrators can inject attacker-controlled table names and configuration values directly into SQL statements across sequence-update, CSV-export, and table-management operations. This chains with a backup-restore ...
CVE-2026-76635 baserCMS < 5.3.0 SQL Injection and Code Injection via BcDatabaseService.php
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...
EUVD-2026-63365
baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...
CVE-2026-67917
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...
EUVD-2026-60535
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...
CVE-2026-67917
zuraCast versions ≤0.23.7 execute the db.sql file from a backup archive during restore without validation or sanitization, allowing SQL injection and privilege escalation. CVSS 9.8 (network, no auth). A PoC is referenced at https://github.com/luoxuanxi/SQL-Injection-PoC/tree/main/SQL-Injection-Po...
CVE-2026-67917
zuraCast versions up to and including 0.23.7 contain a SQL injection vulnerability in the backup restore functionality. The azuracast:restore command executes the db.sql file extracted from a backup archive without any content validation or sanitization. This allows a remote attacker to escalate...
GO-2026-4591 vulnerabilities
Vulnerabilities for packages: backup-restore-operator-fips, backup-restore-operator...
GO-2025-4116 vulnerabilities
Vulnerabilities for packages: consul-k8s, rke2-runtime-fips, falco-no-driver, backup-restore-operator, cert-manager-fips, gitlab-rails-ce, terraform, etcd, etcd-fips, vault, gitlab-rails-ce-fips, k3s...
CVE-2026-73661
FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...
CVE-2026-73661 FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...
CVE-2026-73661 FreePBX: Authenticated Framework AUTHTYPE Can Be Restored From a Crafted Backup
FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...
EUVD-2026-58484
FreePBX is an open source IP PBX. Prior to 16.0.47 and 17.0.30, the FreePBX Framework module permits a crafted backup to restore the hidden AUTHTYPE setting with the value none through runRestore in ampconf/htdocs/admin/libraries/Builtin/Restore.php. An authenticated user with sufficient...