—
GO-2026-6259
Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero
Quick fix
GO-2026-6259 — github.com/vmware-tanzu/velero: upgrade to the fixed version with the command below.
go get github.com/vmware-tanzu/velero@v1.18.1Details
Velero vulnerable to file path traversal when extracting from backup's tarball in github.com/vmware-tanzu/velero
Are you affected?
Enter the version of the package you're using.
Affected packages
Go / github.com/vmware-tanzu/velero
Introduced in:
0 Fixed in: 1.18.1 Fix
go get github.com/vmware-tanzu/velero@v1.18.1