CVE-2026-61625

VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.

• CWE-22

• https://github.com/VictoriaMetrics/VictoriaMetrics/commit/710c920d6083327042a309e449fae4383617d817
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0
• https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-8q3c-rjr9-xxrp

Published

Aug 20, 2026

Last Modified

Aug 20, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-61609Pterodactyl is a free, open-source game server management pa…7.5
• CVE-2026-6161A vulnerability was determined in code-projects Simple ChatB…7.3
• CVE-2026-61613Cursor is a code editor built for programming with AI. Prior…7.7
• CVE-2026-61614SolidInvoice is an open-source invoicing platform. Prior to …5.9
• CVE-2026-61617Wings is the server control plane for the Pterodactyl game-s…7.7
• CVE-2026-6162A vulnerability has been found in PHPGurukul Company Visitor…3.5
• CVE-2026-6163A vulnerability was identified in code-projects Lost and Fou…7.3
• CVE-2026-61632PyMdown Extensions is a set of extensions for the Python-Mar…5.3
• CVE-2026-61634The RabbitMQ Java client library allows Java and JVM-based a…0
• CVE-2026-61638Wallos is an open-source, self-hostable personal subscriptio…8.2
• CVE-2026-61639Wallos is an open-source, self-hostable personal subscriptio…8.5
• CVE-2026-6164A security flaw has been discovered in code-projects Lost an…7.3