{"action":"Upgrade github.com/VictoriaMetrics/VictoriaMetrics to 1.122.25 or later.","affected":[{"fixed":"1.146.0","introduced":"1.137.0"},{"fixed":"1.136.12","introduced":"1.123.0"},{"fixed":"1.122.25","introduced":"0"}],"component":"github.com/VictoriaMetrics/VictoriaMetrics","cve_ids":["CVE-2026-61625"],"ecosystem":"Go","epss":0.00405,"exploited":false,"fixed_versions":["1.146.0","1.136.12","1.122.25"],"ghsa_id":"GHSA-8q3c-rjr9-xxrp","id":"tcs_01M5KF45CPPF5ZRNGKGS8VXG2N","modified_at":"2026-09-15T19:10:30.569335550Z","published_at":"2026-09-03T17:49:29Z","references":["https://osv.dev/vulnerability/GHSA-8q3c-rjr9-xxrp","https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-8q3c-rjr9-xxrp","https://nvd.nist.gov/vuln/detail/CVE-2026-61625","https://github.com/VictoriaMetrics/VictoriaMetrics/commit/710c920d6083327042a309e449fae4383617d817","https://github.com/VictoriaMetrics/VictoriaMetrics","https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25","https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12","https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0"],"severity":{"label":"medium","score":6.8},"sources":[{"source":"osv","source_id":"GHSA-8q3c-rjr9-xxrp","url":"https://osv.dev/vulnerability/GHSA-8q3c-rjr9-xxrp"}],"summary":"VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root"}