Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-124029 (GCVE-0-2026-124029)

Vulnerability from cvelistv5 – Published: 2026-11-06 19:14 – Updated: 2026-11-06 19:14

Title

Kopia through 0.23.1 Path Traversal in Snapshot Restore via Directory Entry Names

Summary

Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

5.7 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

VulnCheck CNA

References

4 references

URL	Tags
https://github.com/kopia/kopia/issues/5700	issue-tracking
https://github.com/kopia/kopia	product
https://github.com/kopia/kopia/blob/v0.23.1/snaps…	technical-description
https://www.vulncheck.com/advisories/kopia-throug…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
kopia	kopia	Affected: 0 , ≤ 0.23.1 (semver)

Date Public

2026-10-09 00:00

Credits

George Chen

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "packageURL": "pkg:golang/github.com/kopia/kopia",
          "product": "kopia",
          "vendor": "kopia",
          "versions": [
            {
              "lessThanOrEqual": "0.23.1",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "George Chen"
        }
      ],
      "datePublic": "2026-10-09T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named \u0027..\u0027, so victims restoring with default options write attacker-chosen content outside the restore directory."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "LOW",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-06T19:14:46.245Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #5700",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/kopia/kopia/issues/5700"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/kopia/kopia"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/kopia/kopia/blob/v0.23.1/snapshot/restore/restore.go#L397"
        },
        {
          "name": "VulnCheck Advisory: Kopia through 0.23.1 Path Traversal in Snapshot Restore via Directory Entry Names",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/kopia-through-0.23.1-path-traversal-in-snapshot-restore-via-directory-entry-names"
        }
      ],
      "title": "Kopia through 0.23.1 Path Traversal in Snapshot Restore via Directory Entry Names",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-124029",
    "datePublished": "2026-11-06T19:14:46.245Z",
    "dateReserved": "2026-11-06T18:51:27.887Z",
    "dateUpdated": "2026-11-06T19:14:46.245Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-45695 (GCVE-0-2026-45695)

Vulnerability from cvelistv5 – Published: 2026-07-16 15:42 – Updated: 2026-07-16 18:08

Title

Kopia: Unauthenticated RCE via SSH ProxyCommand Injection when --insecure --without-password is used

Summary

Kopia is a cross-platform backup tool for Windows, macOS, and Linux with fast incremental backups, client-side end-to-end encryption, compression, and data deduplication. Prior to 0.23.0, Kopia's HTTP server started with --without-password accepts unauthenticated requests to /api/v1/repo/exists and forwards attacker-supplied SFTP storage configuration to blob.NewStorage, where externalSSH: true and sshArguments containing -oProxyCommand=<cmd> can cause exec.CommandContext("ssh") to invoke the command through OpenSSH. This issue is fixed in version 0.23.0.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-07-16 18:06 UTC

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-306 - Missing Authentication for Critical Function