CVE-2026-62268
borg extract might modify out-of-tree files when extracting maliciously crafted archives
Published Oct 15, 2026 · corrected/updated Oct 15, 2026 · evidence confidence high
### Impact A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd"). When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory. In a quite similar scenario, a crafted archive could contain a slave hardlink item with the hardlink source pointing outside the extraction directory. When extracting such an item, borg would hard-link the outside and the inside item. Note: that sounds bad, but it is no big issue in practice: to create such a malicious archive, the attacker would need repository access and (for encrypted or authenticated repos) also the borg key and passphrase. Affected: likely all borg releases before 1.4.5 (and also all borg 2.0.0 betas before b22). ### Patches - 1.4.x release series: fix released with 1.4.5. commits 3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f and 141888f2fabcd57a300547c2aa63212cb213924d. - 1.2.x release series: no new releases any more, fix commits available on 1.2-maint branch: 0ac568e290518c3bbe781459978720dde7fab224 and d907f2cb57337041c4fa55ca4682895535e5076b - 2.0.0 betas: fix will be in 2.0.0b22, fix commits on master branch: 2d632531028b09da8ab5d1450f89bebcc205d640 and 4f37fdfed10b50559a0dd333b0d5581c642af329 ### Workarounds For encrypted or authenticated repositories, do not share borg key and passphrase with potential attackers. For all kinds of repositories, do not share repository access with potential attackers. Usually, the repository access is protected by means outside of borg; e.g. a ssh key for remote repositories or physical access to local storage media. ### References This issue was first discovered by AI in a private code security review initiated by @ThomasWaldmann. A few days later, it was also independently reported to @ThomasWaldmann by: - Michael Head (machin0r) - Chinnapak Charoensiri [Github: Ziim-ei
Grounded briefings
Catalog interpretations for three audiences. Each brief cites ingested metadata and the original advisories below. They are not independent research and they do not invent exploit steps.
Executive
CVE-2026-62268 is a unknown public vulnerability record for this product. It is not currently listed in the CISA Known Exploited catalog. Check the linked vendor or CERT advisories for patch status. This summary is a catalog interpretation of the ingested metadata and cites the original advisories below.
System administrator
Identify whether this product is in your estate, then compare installed versions with the affected ranges. Affected packages or ranges on record: borgbackup (0 → 1.4.5); borgbackup (2.0.0b1 → 2.0.0b22); borgbackup. Check the linked vendor or CERT advisories for patch status. Prefer the vendor or distribution advisory linked in Sources before changing production systems. This is a catalog interpretation, not a runbook.
Security analyst
Signals on file: no CVSS/EPSS yet. It is not currently listed in the CISA Known Exploited catalog. Weakness classes: CWE-59. Sources contributing to this record: cve_org, github, gitlab, osv. Public exploit references, when present, are outbound links only and are not proof of active exploitation. This is a catalog interpretation of stored metadata.
Exploitation and remediation
Exploitation evidence
Not listed as known exploited in CISA KEV. Not in CISA KEV or VulnCheck KEV.
Patch and remediation
No required-action text is stored yet. Use the vendor or CERT links in Sources for patch availability.
Safe detection guidance
Compare installed versions with the affected ranges below and verify the advisory from the original publisher. This site stores metadata and outbound links only; it does not ship exploit code or proof-of-concept payloads.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 15, 2026 · GitHub Advisory Database
Detected
### Impact A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd"). When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory. In a quite similar scenario, a crafted archive could co
Oct 15, 2026 · GitHub Advisory Database
Fix available
borgbackup fixed in 1.4.5; borgbackup fixed in 2.0.0b22
Oct 15, 2026 · GitHub Advisory Database
Fix available
borgbackup fixed in 1.4.5
Oct 15, 2026 · GitHub Advisory Database
Fix available
borgbackup fixed in 2.0.0b22
Oct 15, 2026 · GitHub Advisory Database
Updated
### Impact A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd"). When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory. In a quite similar scenario, a crafted archive could co
Affected
- PyPI borgbackup0 → 1.4.5
- PyPI borgbackup2.0.0b1 → 2.0.0b22
- pypi borgbackupversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-62268
Official CVE identifier
cve.org - GitHub Advisory DatabasePackage advisoryGHSA-gfp8-w835-v44j
GitHub Advisory Database record mirrored by OSV.
github.com - GitLab Advisory DatabasePackage advisoryCVE-2026-62268
A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd"). When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory. In a quite similar scenario, a crafted archive could contain a sla
advisories.gitlab.com - OpenSSF OSV / OSV ScannerPackage advisoryGHSA-gfp8-w835-v44j
borg extract might modify out-of-tree files when extracting maliciously crafted archives
osv.dev