—
GO-2026-6366
Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics
Quick fix
GO-2026-6366 — github.com/VictoriaMetrics/VictoriaMetrics: upgrade to the fixed version with the command below.
go get github.com/VictoriaMetrics/VictoriaMetrics@v1.122.25Details
Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/github.com/VictoriaMetrics/VictoriaMetrics
Introduced in:
0Fixed in: 1.122.25Fix
go get github.com/VictoriaMetrics/VictoriaMetrics@v1.122.25References
- https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-8q3c-rjr9-xxrp[ADVISORY]
- https://github.com/VictoriaMetrics/VictoriaMetrics/commit/710c920d6083327042a309e449fae4383617d817[FIX]
- https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25[WEB]
- https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12[WEB]
- https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0[WEB]