tocsin

Go/github.com/VictoriaMetrics/VictoriaMetrics CVE-2026-61625: unknown, EPSS 0.40%

Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics

Action: Upgrade github.com/VictoriaMetrics/VictoriaMetrics to 1.122.25 or later.

go get github.com/VictoriaMetrics/VictoriaMetrics@v1.122.25
go get github.com/VictoriaMetrics/VictoriaMetrics@v1.136.12
go get github.com/VictoriaMetrics/VictoriaMetrics@v1.146.0

Affected

introducedfixedlast affected
01.122.25-
1.123.01.136.12-
1.137.01.146.0-

Fixed versions

1.122.251.136.121.146.0

Sources

CVE-2026-61625 · published · modified · JSON