CVE-2026-64825: Home Assistant Core Path Traversal Vulnerability via Backup Upload
Summary
CVE-2026-64825: Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding. Affects homeassistant versions < 2026.6.0. Fixed in 2026.6.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Home Assistant Core is an open-source home automation platform that focuses on privacy and local control. It allows users to automate their homes and integrate various devices and services. The platform is extensible and supports a wide range of integrations. However, prior to version 2026.6.0, it was found to be vulnerable to a path traversal attack during the onboarding process, which could allow unauthorized file access on the host system.
Vulnerability Detail
The vulnerability arises from improper handling of file paths during the backup upload process in Home Assistant Core. Specifically, the application allows unauthenticated attackers to upload a crafted backup archive that can manipulate the 'name' field in the backup.json file. This manipulation can lead to the application writing files to arbitrary locations on the filesystem, potentially allowing attackers to gain full access to sensitive files, especially if the application is running with root privileges. The vulnerability is classified under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).
How To Fix
Latest published version: 2026.10.2 as of 22 Oct 2026
pip install --upgrade "homeassistant==2026.10.2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2026.6.0
This is the first release that contains the fix.
pip install --upgrade "homeassistant==2026.6.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the onboarding process or disable the backup upload feature until the application is updated to the patched version. Additionally, running the application with limited privileges can help reduce the impact of this vulnerability.
Conclusion
In summary, the path traversal vulnerability in Home Assistant Core prior to version 2026.6.0 poses a significant risk to users, allowing unauthorized file access through crafted backup uploads. It is crucial for users to update to the latest version to mitigate this risk and ensure the security of their systems.
See every vulnerability recorded for homeassistant →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory. This can lead to unauthorized file access and potential data breaches.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any installation.
If exploited, this vulnerability can allow attackers to write arbitrary files to the host filesystem, potentially leading to data loss, unauthorized access to sensitive information, or system compromise.
Yes, you can restrict access to the onboarding process or disable the backup upload feature until you are able to update to the patched version.
The CVSS score of this vulnerability is 9.3, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for homeassistant.
