CVE-2026-64825 PUBLISHED

Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

Assigner: VulnCheck
Reserved: 20.07.2026 Published: 21.07.2026 Updated: 21.07.2026

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.truediv to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
CVSS Score: 9

Product Status

Vendor home-assistant
Product Home Assistant Core
Versions Default: affected
  • affected from 0 to 2026.6.0 (excl.)

Credits

  • Harish Kolla (@Har1sh-k) finder

References

Problem Types

  • Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE