CVE-2026-64825 home-assistant CVE debrief

Who should care

Defenders responsible for Home Assistant Core installations, especially those with exposed instances, should assess their exposure and prioritize verification and remediation. This includes operators, security teams, and vulnerability management teams. They should review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Why it matters

This vulnerability allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem, potentially leading to full filesystem access when the process runs as root.

• Verify and upgrade to version 2026.6.0 or later to prevent arbitrary file writes
• Restrict access to the initial onboarding window to limit attack surface
• Monitor for suspicious backup archive uploads to detect potential attacks

Technical summary

The vulnerability is caused by a path traversal issue in the backup archive upload feature, allowing attackers to manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path. This can lead to arbitrary file writes on the host filesystem, potentially resulting in full filesystem access when the process runs as root. The issue is fixed in version 2026.6.0 or later. Defenders should prioritize verifying and upgrading to the latest version. The vulnerability has a CVSS score of 9 and a severity of CRITICAL.

Defensive priority

Defenders should prioritize verifying and upgrading to version 2026.6.0 or later, and restrict access to the initial onboarding window.

Recommended defensive actions

• Verify and upgrade to version 2026.6.0 or later
• Restrict access to the initial onboarding window
• Monitor for suspicious backup archive uploads
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The vulnerability allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Evidence is limited to the supplied CVE record and source item details. Defenders should verify the affected scope and prioritize remediation. The CVE record was published on 2026-07-21T15:40:18.756Z and has not been modified since then.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.