cve.bz

CVE-2026-32637

5.9 mediumEPSS 0.5%

Medium (5.9). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in github.com/vmware-tanzu/velero 1.18.1.

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

Severity

CVSS 4.0

5.9 medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
CWE
CWE-22
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j2g6-362q-6qc6Gogithub.com/vmware-tanzu/velero<1.18.11.18.1
GO-2026-6259Gogithub.com/vmware-tanzu/velero<1.18.11.18.1

References

Check your stackJSON