CVE-2026-64824 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-64824

CVSS 8.4 · High EPSS 0,80%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Skor CVSS 3.1 8.4 (High) menurut vulncheck.com.

Deskripsi (NVD)

Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assistant process as root and the subsequent regular-file entry is written through the unvalidated symlink, attackers can achieve remote code execution by overwriting auto-imported Python paths such as site-packages/sitecustomize.py or custom component directories.

Rincian

Terbit di NVD: 21 Juli 2026
Terakhir diubah: 21 Juli 2026
Status NVD: Deferred
CVSS 3.1: 8.4 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 0,80% peluang dieksploitasi; lebih tinggi dari 55,3% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.