by Kastro
Paper/Archive/CVE-2026-64825

CVE-2026-64825

home-assistant Home Assistant Core — Home Assistant Core < 2026.6.0 Path Traversal File Write via Backup Upload

EPSS 0.6%CVSS 9.3
critical.is priorityof 100
37
CVSS 9.3 (CNA)9.3 / 10 × 3027.9Not in CISA KEV+300.0EPSS percentile 47.6.476 × 209.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.__truediv__ to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.

Affected

ProductAffectedFixed inSource
Home Assistant Core< 2026.6.02026.6.0CNA

Scores by source

VulnCheck (CNA)9.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L
VulnCheck (CNA)9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

refgithub.com/home-assistant/core/releases/tag/2026.6.0refgithub.com/home-assistant/core/pull/172368patchgithub.com/home-assistant/core/commit/567fe858289876b68b8162a77bd46e1e1af79752writeupvulncheck.com/advisories/home-assistant-core-path-traversal-file-write-via-backup-upload