{"action":"Upgrade borgbackup to 1.4.5 or later.","affected":[{"fixed":"1.4.5","introduced":"0"},{"fixed":"2.0.0b22","introduced":"2.0.0b1"}],"component":"borgbackup","cve_ids":["CVE-2026-62268"],"ecosystem":"PyPI","exploited":false,"fixed_versions":["1.4.5","2.0.0b22"],"ghsa_id":"GHSA-gfp8-w835-v44j","id":"tcs_01M5JHGCYBRWK3F5S46JRGZWXK","modified_at":"2026-10-15T20:30:06.122266542Z","published_at":"2026-10-15T20:09:23Z","references":["https://osv.dev/vulnerability/GHSA-gfp8-w835-v44j","https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j","https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224","https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d","https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640","https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f","https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329","https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b","https://github.com/borgbackup/borg","https://github.com/borgbackup/borg/releases/tag/1.4.5","https://github.com/borgbackup/borg/releases/tag/2.0.0b22"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-gfp8-w835-v44j","url":"https://osv.dev/vulnerability/GHSA-gfp8-w835-v44j"}],"summary":"borg extract might modify out-of-tree files when extracting maliciously crafted archives"}