CVE-2026-64825 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-64825

CVSS 9.3 · Critical EPSS 0,58%

Kerentanan Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'). Skor CVSS 3.1 9.3 (Critical) menurut vulncheck.com.

Deskripsi (NVD)

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.__truediv__ to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.

Rincian

Terbit di NVD: 21 Juli 2026
Terakhir diubah: 8 Oktober 2026
Status NVD: Deferred
CVSS 3.1: 9.3 (Critical), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
EPSS (30 hari): 0,58% peluang dieksploitasi; lebih tinggi dari 46,1% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 9 Okt 2026, 06:25 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.