---
id: "CVE-2026-124029"
page: "https://infrastack.ai/live/CVE-2026-124029"
kind: "vulnerability"
aliases: ["CVE-2026-124029"]
title: "Kopia: crafted snapshot entries let restores write files outside the target directory"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["backup", "kopia", "package", "self-hosted"]
not_affected_if: ["read-only-repository", "trusted-writers-only"]
published_at: "2026-11-06T20:17:21+00:00"
first_seen_at: "2026-11-06T20:43:59+00:00"
updated_at: "2026-11-06T20:44:14+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124029", "first_seen_at": "2026-11-06T20:43:59+00:00"}]
exploit_sources: []
---

# Kopia: crafted snapshot entries let restores write files outside the target directory

Link for people: https://infrastack.ai/live/CVE-2026-124029 (this .md is for agents)

Kopia through 0.23.1 has a path traversal flaw in its restore code: directory entries named '..' are not blocked. A user with repository write access can craft a snapshot so that a victim's default restore writes attacker-chosen content outside the restore directory.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kopia version with `kopia --version` and compare it to the fixed release in the sources.
- Find who has write access to the Kopia repository, since only those users can create the crafted snapshots.

## Timeline

- 2026-11-06T20:43:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124029

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/kopia-through-0.23.1-path-traversal-in-snapshot-restore-via-directory-entry-names

## From the sources

Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_