tocsin

CVE-2026-61625

2 advisories.

Go/github.com/VictoriaMetrics/VictoriaMetrics CVE-2026-61625: medium 6.8

VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

Action: Upgrade github.com/VictoriaMetrics/VictoriaMetrics to 1.122.25 or later.

go get github.com/VictoriaMetrics/VictoriaMetrics@v1.146.0
go get github.com/VictoriaMetrics/VictoriaMetrics@v1.136.12
go get github.com/VictoriaMetrics/VictoriaMetrics@v1.122.25

Affected

introducedfixedlast affected
1.137.01.146.0-
1.123.01.136.12-
01.122.25-

Fixed versions

1.146.01.136.121.122.25

Sources

CVE-2026-61625 · published · modified · JSON

Go/github.com/VictoriaMetrics/VictoriaMetrics CVE-2026-61625: unknown

Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics

Action: Upgrade github.com/VictoriaMetrics/VictoriaMetrics to 1.122.25 or later.

go get github.com/VictoriaMetrics/VictoriaMetrics@v1.122.25
go get github.com/VictoriaMetrics/VictoriaMetrics@v1.136.12
go get github.com/VictoriaMetrics/VictoriaMetrics@v1.146.0

Affected

introducedfixedlast affected
01.122.25-
1.123.01.136.12-
1.137.01.146.0-

Fixed versions

1.122.251.136.121.146.0

Sources

CVE-2026-61625 · published · modified · JSON