{"action":"Upgrade github.com/VictoriaMetrics/VictoriaMetrics to 1.122.25 or later.","affected":[{"fixed":"1.122.25","introduced":"0"},{"fixed":"1.136.12","introduced":"1.123.0"},{"fixed":"1.146.0","introduced":"1.137.0"}],"component":"github.com/VictoriaMetrics/VictoriaMetrics","cve_ids":["CVE-2026-61625"],"ecosystem":"Go","epss":0.00405,"exploited":false,"fixed_versions":["1.122.25","1.136.12","1.146.0"],"ghsa_id":"GHSA-8q3c-rjr9-xxrp","id":"tcs_01M5KGTEJM8AP7S4YYCV7QR6WH","modified_at":"2026-09-15T19:00:16.417090212Z","published_at":"2026-09-15T18:39:25Z","references":["https://osv.dev/vulnerability/GO-2026-6366","https://github.com/VictoriaMetrics/VictoriaMetrics/security/advisories/GHSA-8q3c-rjr9-xxrp","https://github.com/VictoriaMetrics/VictoriaMetrics/commit/710c920d6083327042a309e449fae4383617d817","https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.122.25","https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.136.12","https://github.com/VictoriaMetrics/VictoriaMetrics/releases/tag/v1.146.0"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2026-6366","url":"https://osv.dev/vulnerability/GO-2026-6366"}],"summary":"Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics"}