CVE-2026-67449 · Package
NO FIX YET · SEE WHAT TO DO
Portabase is a database backup and restore tool. A path traversal in its TUS upload webhook handler lets an unauthenticated attacker overwrite arbitrary files in the private data directory, including the AES-256-GCM master key used to protect stored data.
first public Jul 4, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that self-host Portabase with its TUS upload endpoint reachable over the network are exposed, since the flaw needs no login. Instances on a version below 1.21.2 are the ones to look at; the sources do not say whether managed hosting is affected.
Not affected if version-1.21.2-or-later
Who cares backups, portabase, self-hosted
1.21.2.app/api/tus/hooks/route.ts in the deployed application and confirm it is reachable from the internet./data/private/keys/master_key.bin exists and when it was last modified.1.21.2 or later.Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/master_key.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.