Go/github.com/VictoriaMetrics/VictoriaMetrics CVE-2026-61625: medium 6.8, EPSS 0.40%

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

Action: Upgrade github.com/VictoriaMetrics/VictoriaMetrics to 1.122.25 or later.

go get github.com/VictoriaMetrics/VictoriaMetrics@v1.146.0

go get github.com/VictoriaMetrics/VictoriaMetrics@v1.136.12

go get github.com/VictoriaMetrics/VictoriaMetrics@v1.122.25

Affected

Fixed versions

Sources

• osv: GHSA-8q3c-rjr9-xxrp
• https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-8q3c-rjr9-xxrp
• https://nvd.nist.gov/vuln/detail/CVE-2026-61625
• https://github.com/VictoriaMetrics/VictoriaMetrics/commit/710c920d6083327042a309e449fae4383617d817
• https://github.com/VictoriaMetrics/VictoriaMetrics
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12
• https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0

CVE-2026-61625 · published 2026-09-03T17:49:29Z · modified 2026-09-15T19:10:30.569335550Z · JSON