CVE-2026-62268 borgbackup CVE debrief

Who should care

Defenders handling archives from untrusted sources, especially in environments where repository access and borg keys are managed, should assess exposure and verify their borg installation.

Why it matters

Defenders should prioritize verifying their borg installation and ensuring it is up-to-date, especially if they handle archives from untrusted sources, as a maliciously crafted archive could cause borg extract to modify out-of-tree files.

• Verify and update borg installations to prevent potential file modifications
• Review and secure archive extraction processes to handle untrusted sources
• Monitor for suspicious archive extraction activities to detect potential exploitation attempts

Technical summary

A maliciously crafted archive could contain a symlink or an item with a path embedding '..' that, when extracted using borg, could delete or overwrite files outside the extraction directory. A crafted archive could also contain a slave hardlink item with the hardlink source pointing outside the extraction directory, leading to hard-linking of outside and inside items. This issue affects borg releases before 1.4.5 and 2.0.0 betas before b22. The vulnerability allows attackers with repository access and borg keys to potentially overwrite or delete files outside the extraction directory using specially crafted archives.

Defensive priority

Defenders should prioritize verifying their borg installation and ensuring it is up-to-date, especially if they handle archives from untrusted sources.

Recommended defensive actions

• Verify the borg installation and ensure it is up-to-date
• Review archive extraction processes to handle untrusted sources securely
• Monitor for suspicious archive extraction activities
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including its impact and patches. However, the corpus does not establish versions, exploitation, impact, or remediation beyond what is provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.