CVE-2026-62268: borgbackup Symlink and Hardlink Vulnerability Leading to Out-of-Tree File Modification
Summary
CVE-2026-62268: borg extract might modify out-of-tree files when extracting maliciously crafted archives. Affects borgbackup across 2 version ranges.
< 1.4.5
>= 2.0.0b1, < 2.0.0b22
Fixed in 1.4.5 or 2.0.0b22, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
borgbackup is an open-source deduplicating backup program that efficiently manages backup archives. It allows users to create, manage, and restore backups while ensuring data integrity and security. However, certain versions of borgbackup are vulnerable to a flaw that can lead to unintended modifications of files outside the designated extraction directory, particularly when handling maliciously crafted archives.
Vulnerability Detail
The vulnerability arises from the way borgbackup processes symlinks and paths containing '..' during the extraction of archives. A maliciously crafted archive could include a symlink pointing to a sensitive directory (e.g., '/etc') or an item with a path that navigates outside the extraction directory. This could lead to the deletion or overwriting of critical files. Although the risk is mitigated by requiring repository access and credentials, the potential for exploitation remains a significant concern.
How To Fix
Latest published version: 1.4.5 as of 23 Oct 2026
pip install --upgrade "borgbackup==1.4.5"The newest release already contains this fix.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 2.0.0b1, < 2.0.0b222.0.0b22pip install --upgrade "borgbackup==2.0.0b22"
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
For encrypted or authenticated repositories, do not share the borg key and passphrase with potential attackers. Additionally, restrict repository access to prevent unauthorized users from creating malicious archives.
Conclusion
The borgbackup vulnerability CVE-2026-62268 poses a risk of unauthorized file modification through maliciously crafted archives. Users are strongly advised to update to the latest patched versions to mitigate this risk and implement recommended workarounds to enhance security.
See every vulnerability recorded for borgbackup →
FAQ
CVE-2026-62268 is a vulnerability in borgbackup that allows maliciously crafted archives to modify files outside the extraction directory.
All borgbackup releases before 1.4.5 and all 2.0.0 beta versions before b22 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If updating is not possible, ensure that repository access is tightly controlled and avoid sharing sensitive credentials with potential attackers.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for borgbackup.
