CVE-2026-61625 VictoriaMetrics CVE debrief

Who should care

Operators and administrators of VictoriaMetrics systems should assess exposure and apply updates to prevent potential path traversal attacks. This includes reviewing and updating affected systems to versions 1.122.25, 1.136.12, or 1.146.0, and monitoring for suspicious activity related to vmrestore and VictoriaMetrics. Security teams should also review compensating controls for exposed systems while remediation is scheduled and verified.

Why it matters

CVE-2026-61625 is a path traversal vulnerability in VictoriaMetrics vmrestore that allows an attacker to create or overwrite files outside the intended restore root. Operators and administrators of VictoriaMetrics systems should assess exposure and apply updates to prevent potential path traversal attacks. The issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.

• Path traversal attacks may lead to unauthorized file creation or overwrite.
• Successful exploitation requires supply-chain or backup source compromise.
• Defenders should verify and apply updates to vmrestore to prevent potential attacks.
• Remediation priority is high for systems using affected vmrestore versions.

Technical summary

The CVE-2026-61625 vulnerability in VictoriaMetrics vmrestore allows an attacker to create or overwrite files outside the intended restore root. The issue is caused by a lack of validation of backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names, which can be used to create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process.

Defensive priority

Operators should verify and apply updates to vmrestore to prevent potential path traversal attacks.

Recommended defensive actions

• Verify and apply updates to vmrestore to prevent potential path traversal attacks.
• Review and update affected systems to versions 1.122.25, 1.136.12, or 1.146.0.
• Monitor for suspicious activity related to vmrestore and VictoriaMetrics.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in VictoriaMetrics vmrestore, which allows an attacker to create or overwrite files outside the intended restore root. The issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.