{"id":"CVE-2026-124029","kind":"vulnerability","aliases":["CVE-2026-124029"],"related":[],"title":"Kopia: crafted snapshot entries let restores write files outside the target directory","description":"Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory.","summary":"Kopia through 0.23.1 has a path traversal flaw in its restore code: directory entries named '..' are not blocked. A user with repository write access can craft a snapshot so that a victim's default restore writes attacker-chosen content outside the restore directory.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backup","kopia","package","self-hosted"],"not_affected_if":["read-only-repository","trusted-writers-only"],"how_to_check":"- Check the installed Kopia version with `kopia --version` and compare it to the fixed release in the sources.\n- Find who has write access to the Kopia repository, since only those users can create the crafted snapshots.","fix":null,"status":"open","published_at":"2026-11-06T20:17:21+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","triaged_at":"2026-11-06T20:44:14+00:00","updated_at":"2026-11-06T20:44:14+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T20:44:14Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Kopia: crafted snapshot entries let restores write files outside the target directory","impact":"medium","summary":"Kopia through 0.23.1 has a path traversal flaw in its restore code: directory entries named '..' are not blocked. A user with repository write access can craft a snapshot so that a victim's default restore writes attacker-chosen content outside the restore directory.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kopia","backup","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker-chosen content is written to arbitrary files outside the restore directory.","analyst_note":"Confirm the first fixed Kopia version and whether the fix is in a release, using the NVD entry and the VulnCheck advisory linked from the signal.","how_to_check":"- Check the installed Kopia version with `kopia --version` and compare it to the fixed release in the sources.\n- Find who has write access to the Kopia repository, since only those users can create the crafted snapshots.","plain_action":"","needs_analyst":true,"not_affected_if":["read-only-repository","trusted-writers-only"],"who_is_affected":"Teams that restore Kopia snapshots from a repository where untrusted or less-trusted users can write snapshots are exposed. The victim must run a restore with default options. Teams where only trusted administrators can write to the repository have a much smaller risk and can plan the upgrade as routine.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000704,"input_tokens":4258,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124029':15A,18A '-2026':14A,17A '0.23.1':27B,71C 'access':48B,85C 'allow':80C 'attack':62B,95C,113C 'attacker-chosen':61B,112C 'backup':19B 'block':42B 'chosen':63B,114C 'code':36B 'contain':72C 'content':64B,115C 'copydirectorycont':78C 'craft':2A,50B,92C 'creat':97C 'cve':13A,16A 'default':58B,109C 'directori':12A,37B,68B,90C,100C,119C 'entri':4A,38B,93C,102C 'escap':87C 'file':8A 'flaw':32B 'host':24B 'kopia':1A,20B,25B,69C 'let':5A 'manifest':101C 'name':39B,94C,104C 'option':110C 'outsid':9A,65B,116C 'packag':21B 'path':30B,74C 'repositori':46B,83C 'restor':6A,35B,59B,67B,89C,107C,118C 'self':23B 'self-host':22B 'snapshot':3A,52B,98C 'target':11A 'travers':31B,75C 'user':44B,81C 'via':91C 'victim':56B,106C 'vulner':76C 'whose':99C 'write':7A,47B,60B,84C,111C","nicknames":[],"mitigations":[],"who_affected":"Teams that restore Kopia snapshots from a repository where untrusted or less-trusted users can write snapshots are exposed. The victim must run a restore with default options. Teams where only trusted administrators can write to the repository have a much smaller risk and can plan the upgrade as routine.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backup","kopia","medium","package","selfhosted"],"campaign_type":null,"search_a":"'-124029':15A,18A '-2026':14A,17A 'craft':2A 'cve':13A,16A 'directori':12A 'entri':4A 'file':8A 'kopia':1A 'let':5A 'outsid':9A 'restor':6A 'snapshot':3A 'target':11A 'write':7A","search_b":"'0.23.1':27B 'access':48B 'attack':62B 'attacker-chosen':61B 'backup':19B 'block':42B 'chosen':63B 'code':36B 'content':64B 'craft':50B 'default':58B 'directori':37B,68B 'entri':38B 'flaw':32B 'host':24B 'kopia':20B,25B 'name':39B 'outsid':65B 'packag':21B 'path':30B 'repositori':46B 'restor':35B,59B,67B 'self':23B 'self-host':22B 'snapshot':52B 'travers':31B 'user':44B 'victim':56B 'write':47B,60B","search_c":"'0.23.1':71C 'access':85C 'allow':80C 'attack':95C,113C 'attacker-chosen':112C 'chosen':114C 'contain':72C 'content':115C 'copydirectorycont':78C 'craft':92C 'creat':97C 'default':109C 'directori':90C,100C,119C 'entri':93C,102C 'escap':87C 'kopia':69C 'manifest':101C 'name':94C,104C 'option':110C 'outsid':116C 'path':74C 'repositori':83C 'restor':89C,107C,118C 'snapshot':98C 'travers':75C 'user':81C 'via':91C 'victim':106C 'vulner':76C 'whose':99C 'write':84C,111C","first_public_at":"2026-11-06T20:17:21+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124029","severity":null,"published_at":"2026-11-06T20:17:21+00:00","modified_at":"2026-11-06T20:17:21+00:00","first_seen_at":"2026-11-06T20:43:59+00:00","fetched_at":"2026-11-06T20:43:59+00:00","note":null}],"documents":[{"id":89782,"url":"https://www.vulncheck.com/advisories/kopia-through-0.23.1-path-traversal-in-snapshot-restore-via-directory-entry-names","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}