PyPI/borgbackup CVE-2026-62268: medium
borg extract might modify out-of-tree files when extracting maliciously crafted archives
Action: Upgrade borgbackup to 1.4.5 or later.
pip install borgbackup==1.4.5pip install borgbackup==2.0.0b22Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.4.5 | - |
| 2.0.0b1 | 2.0.0b22 | - |
Fixed versions
| 1.4.5 | 2.0.0b22 |
Sources
- osv: GHSA-gfp8-w835-v44j
- https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j
- https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224
- https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d
- https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640
- https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f
- https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329
- https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b
- https://github.com/borgbackup/borg
- https://github.com/borgbackup/borg/releases/tag/1.4.5
- https://github.com/borgbackup/borg/releases/tag/2.0.0b22
CVE-2026-62268 · published · modified · JSON