CVE-2026-62268
borg extract might modify out-of-tree files when extracting maliciously crafted archives
Impact
A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd").
When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory.
In a quite similar scenario, a crafted archive could contain a slave hardlink item with the hardlink source pointing outside the extraction directory.
When extracting such an item, borg would hard-link the outside and the inside item.
Note: that sounds bad, but it is no big issue in practice: to create such a malicious archive, the attacker would need repository access and (for encrypted or authenticated repos) also the borg key and passphrase.
Affected: likely all borg releases before 1.4.5 (and also all borg 2.0.0 betas before b22).
Patches
- 1.4.x release series: fix released with 1.4.5. commits 3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f and 141888f2fabcd57a300547c2aa63212cb213924d.
- 1.2.x release series: no new releases any more, fix commits available on 1.2-maint branch: 0ac568e290518c3bbe781459978720dde7fab224 and d907f2cb57337041c4fa55ca4682895535e5076b
- 2.0.0 betas: fix will be in 2.0.0b22, fix commits on master branch: 2d632531028b09da8ab5d1450f89bebcc205d640 and 4f37fdfed10b50559a0dd333b0d5581c642af329
Workarounds
For encrypted or authenticated repositories, do not share borg key and passphrase with potential attackers.
For all kinds of repositories, do not share repository access with potential attackers. Usually, the repository access is protected by means outside of borg; e.g. a ssh key for remote repositories or physical access to local storage media.
References
This issue was first discovered by AI in a private code security review initiated by @ThomasWaldmann.
A few days later, it was also independently reported to @ThomasWaldmann by:
- Michael Head (machin0r)
- Chinnapak Charoensiri [Github: Ziim-eiei].
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- Active
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-gfp8-w835-v44j
borg extract might modify out-of-tree files when extracting maliciously crafted archives
Impact
A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd").
When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory.
In a quite similar scenario, a crafted archive could contain a slave hardlink item with the hardlink source pointing outside the extraction directory.
When extracting such an item, borg would hard-link the outside and the inside item.
Note: that sounds bad, but it is no big issue in practice: to create such a malicious archive, the attacker would need repository access and (for encrypted or authenticated repos) also the borg key and passphrase.
Affected: likely all borg releases before 1.4.5 (and also all borg 2.0.0 betas before b22).
Patches
- 1.4.x release series: fix released with 1.4.5. commits 3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f and 141888f2fabcd57a300547c2aa63212cb213924d.
- 1.2.x release series: no new releases any more, fix commits available on 1.2-maint branch: 0ac568e290518c3bbe781459978720dde7fab224 and d907f2cb57337041c4fa55ca4682895535e5076b
- 2.0.0 betas: fix will be in 2.0.0b22, fix commits on master branch: 2d632531028b09da8ab5d1450f89bebcc205d640 and 4f37fdfed10b50559a0dd333b0d5581c642af329
Workarounds
For encrypted or authenticated repositories, do not share borg key and passphrase with potential attackers.
For all kinds of repositories, do not share repository access with potential attackers. Usually, the repository access is protected by means outside of borg; e.g. a ssh key for remote repositories or physical access to local storage media.
References
This issue was first discovered by AI in a private code security review initiated by @ThomasWaldmann.
A few days later, it was also independently reported to @ThomasWaldmann by:
- Michael Head (machin0r)
- Chinnapak Charoensiri [Github: Ziim-eiei].
- Record
GHSA-gfp8-w835-v44j- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVGHSA-gfp8-w835-v44j
borg extract might modify out-of-tree files when extracting maliciously crafted archives
Impact
A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd").
When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory.
In a quite similar scenario, a crafted archive could contain a slave hardlink item with the hardlink source pointing outside the extraction directory.
When extracting such an item, borg would hard-link the outside and the inside item.
Note: that sounds bad, but it is no big issue in practice: to create such a malicious archive, the attacker would need repository access and (for encrypted or authenticated repos) also the borg key and passphrase.
Affected: likely all borg releases before 1.4.5 (and also all borg 2.0.0 betas before b22).
Patches
- 1.4.x release series: fix released with 1.4.5. commits 3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f and 141888f2fabcd57a300547c2aa63212cb213924d.
- 1.2.x release series: no new releases any more, fix commits available on 1.2-maint branch: 0ac568e290518c3bbe781459978720dde7fab224 and d907f2cb57337041c4fa55ca4682895535e5076b
- 2.0.0 betas: fix will be in 2.0.0b22, fix commits on master branch: 2d632531028b09da8ab5d1450f89bebcc205d640 and 4f37fdfed10b50559a0dd333b0d5581c642af329
Workarounds
For encrypted or authenticated repositories, do not share borg key and passphrase with potential attackers.
For all kinds of repositories, do not share repository access with potential attackers. Usually, the repository access is protected by means outside of borg; e.g. a ssh key for remote repositories or physical access to local storage media.
References
This issue was first discovered by AI in a private code security review initiated by @ThomasWaldmann.
A few days later, it was also independently reported to @ThomasWaldmann by:
- Michael Head (machin0r)
- Chinnapak Charoensiri [Github: Ziim-eiei].
- Record
GHSA-gfp8-w835-v44j- CVSS 4.0
- 5.3 Medium
CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-59
- Updated
- 2026-11-02
OSVMGASA-2026-0440 No score
Updated borgbackup package fixes a security vulnerability
The updated package fixes a security vulnerability: CVE-2026-62268.
- Record
MGASA-2026-0440- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-62268 No score
[Unknown description]
- Record
UBUNTU-CVE-2026-62268- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
borgbackupPyPI |
before 1.4.5 | 1.4.5 |
borgbackupPyPI |
2.0.0b1 up to 2.0.0b22 | 2.0.0b22 |
borgbackupDebian:12 |
All versions, plus listed versions 1.2.4-11.2.4-21.2.4-31.2.5-11.2.5-2 Show 32 moreShow less1.2.5-31.2.5-41.2.6-11.2.6-21.2.7-11.2.7-21.2.7-2~bpo12+11.2.8-11.2.8-1~bpo12+11.4.0-11.4.0-21.4.0-31.4.0-41.4.0-4~bpo12+11.4.0-51.4.1-11.4.1-21.4.1-31.4.1-3~exp11.4.1-41.4.2-11.4.2-21.4.3-11.4.3-21.4.3-31.4.3-41.4.4-11.4.4-21.4.4-31.4.4-41.4.4-51.4.5-1 |
None known |
borgbackupDebian:13 |
All versions, plus listed versions 1.4.0-51.4.1-11.4.1-21.4.1-31.4.1-3~exp1 Show 13 moreShow less1.4.1-41.4.2-11.4.2-21.4.3-11.4.3-21.4.3-31.4.3-41.4.4-11.4.4-21.4.4-31.4.4-41.4.4-51.4.5-1 |
None known |
borgbackupDebian:14 |
before 1.4.5-1, plus listed versions 1.4.0-51.4.1-11.4.1-21.4.1-31.4.1-3~exp1 Show 12 moreShow less1.4.1-41.4.2-11.4.2-21.4.3-11.4.3-21.4.3-31.4.3-41.4.4-11.4.4-21.4.4-31.4.4-41.4.4-5 |
1.4.5-1 |
borgbackup2Debian:12 |
All versions, plus listed versions 2.0.0b11-12.0.0b11-22.0.0b11-32.0.0b12-12.0.0b12-2 Show 45 moreShow less2.0.0b12-32.0.0b12-42.0.0b12-52.0.0b12-62.0.0b12-72.0.0b13-12.0.0b13-22.0.0b14-12.0.0b14-22.0.0b14-32.0.0b14-42.0.0b15-12.0.0b16-12.0.0b17-12.0.0b17-22.0.0b17-32.0.0b18-12.0.0b18-22.0.0b18-32.0.0b19-12.0.0b19.post2-12.0.0b19.post2-22.0.0b19.post2-32.0.0b20-12.0.0b20-22.0.0b20-32.0.0b20-42.0.0b20-52.0.0b21-12.0.0b22-12.0.0b22-22.0.0b23-12.0.0b23-22.0.0b23-32.0.0b23-42.0.0b23-52.0.0b24-12.0.0b24-22.0.0b24-32.0.0b24-42.0.0b5-12.0.0b5-22.0.0b5-32.0.0b7-12.0.0b7-2 |
None known |
borgbackup2Debian:13 |
All versions, plus listed versions 2.0.0b19-12.0.0b19.post2-12.0.0b19.post2-22.0.0b19.post2-32.0.0b20-1 Show 16 moreShow less2.0.0b20-22.0.0b20-32.0.0b20-42.0.0b20-52.0.0b21-12.0.0b22-12.0.0b22-22.0.0b23-12.0.0b23-22.0.0b23-32.0.0b23-42.0.0b23-52.0.0b24-12.0.0b24-22.0.0b24-32.0.0b24-4 |
None known |
borgbackup2Debian:14 |
before 2.0.0b22-1, plus listed versions 2.0.0b19-12.0.0b19.post2-12.0.0b19.post2-22.0.0b19.post2-32.0.0b20-1 Show 5 moreShow less2.0.0b20-22.0.0b20-32.0.0b20-42.0.0b20-52.0.0b21-1 |
2.0.0b22-1 |
borgbackupPyPI |
before 1.4.5, plus listed versions 0.23.00.24.00.25.00.26.00.26.1 Show 45 moreShow less0.27.00.28.00.28.10.28.20.29.00.30.00.30.11.0.01.0.0rc11.0.0rc21.0.11.0.101.0.10rc11.0.111.0.11rc11.0.121.0.131.0.21.0.31.0.41.0.51.0.61.0.6rc11.0.71.0.7rc11.0.7rc21.0.81.0.8rc11.0.91.0.9rc11.1.01.1.0b11.1.0b21.1.0b31.1.0b41.1.0b51.1.0b61.1.0rc11.1.0rc21.1.0rc31.1.0rc41.1.11.1.101.1.111.1.12 |
1.4.5 |
borgbackupPyPI |
2.0.0b1 up to 2.0.0b22, plus listed versions 2.0.0b102.0.0b112.0.0b122.0.0b132.0.0b14 Show 15 moreShow less2.0.0b152.0.0b162.0.0b172.0.0b182.0.0b192.0.0b22.0.0b202.0.0b212.0.0b32.0.0b42.0.0b52.0.0b62.0.0b72.0.0b82.0.0b9 |
2.0.0b22 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
borgbackupMageia:10 |
before 1.4.5-1.mga10 | 1.4.5-1.mga10 |
borgbackupUbuntu:16.04:LTS |
All versions, plus listed versions 0.28.1-10.28.1-20.28.2-10.28.2-20.29.0-1 Show 19 moreShow less0.29.0-20.29.0-30.29.0-40.30.0-11.0.0~rc1-11.0.0~rc1-21.0.0~rc1-31.0.0~rc2-11.0.0~rc2-31.0.0-11.0.0-21.0.0-31.0.0-41.0.1-11.0.2-11.0.7-0ubuntu1.16.04.11.0.11-0ubuntu1.16.04.21.0.12-0ubuntu1.16.04.11.0.13-0ubuntu1.16.04.1 |
None known |
borgbackupUbuntu:18.04:LTS |
All versions, plus listed versions 1.0.11-41.1.2-31.1.2-41.1.2-51.1.3-1build1 Show 9 moreShow less1.1.3-21.1.3-31.1.4-11.1.4-21.1.4-2build11.1.4-31.1.5-1~build11.1.5-11.1.15-1~ubuntu1.18.04.2 |
None known |
borgbackupUbuntu:20.04:LTS |
All versions, plus listed versions 1.1.10-21.1.10-2build11.1.11-1~build11.1.11-11.1.11-21.1.11-5~build11.1.11-51.1.15-1~ubuntu1.20.04.1 |
None known |
borgbackupUbuntu:22.04:LTS |
All versions, plus listed versions 1.1.17-11.1.17-1build11.2.0-11.2.0-1ubuntu1.22.04.1 |
None known |
borgbackupUbuntu:24.04:LTS |
All versions, plus listed versions 1.2.6-21.2.7-11.2.7-21.2.7-2build11.2.7-2build21.2.7-2build31.2.8-1 |
None known |
borgbackup2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.0.0b5-12.0.0b5-1build12.0.0b5-32.0.0b7-22.0.0b7-2build12.0.0b8-22.0.0b8-2build12.0.0b8-2build2 |
None known |
borgbackupUbuntu:26.10 |
All versions, plus listed versions 1.4.4-31.4.5-1 |
None known |
borgbackup2Ubuntu:26.10 |
All versions, plus listed versions 2.0.0b20-52.0.0b24-12.0.0b24-22.0.0b24-42.0.0b25-4 |
None known |
borgbackupUbuntu:26.04:LTS |
All versions, plus listed versions 1.4.1-41.4.3-11.4.3-21.4.3-41.4.4-2~build11.4.4-21.4.4-3 |
None known |
borgbackup2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.0.0b19-12.0.0b19.post2-22.0.0b19.post2-32.0.0b20-1~build12.0.0b20-12.0.0b20-22.0.0b20-42.0.0b20-5 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-62268 is a medium vulnerability (CVSS 5.3) in borgbackup, published July 30, 2026. No source lists public exploit code. Fixed in borgbackup 1.4.5.
References
github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2026-62268
advisories.mageia.org/MGASA-2026-0440.html
bugs.mageia.org/show_bug.cgi?id=36163
lists.fedoraproject.org/archives/list/[email protected]/message/SHGZVBSSCWNFGJ5CQLE5BHFNNORWRSGK
ubuntu.com/security/CVE-2026-62268
cve.org/CVERecord?id=CVE-2026-62268
Left out here: 51 versions. The JSON record has them.