{"id":"CVE-2026-67449","kind":"vulnerability","aliases":["CVE-2026-67449"],"related":[],"title":"Portabase: unauthenticated path traversal lets attackers overwrite the master encryption key","description":"Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/master_key.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2.","summary":"Portabase is a database backup and restore tool. A path traversal in its TUS upload webhook handler lets an unauthenticated attacker overwrite arbitrary files in the private data directory, including the AES-256-GCM master key used to protect stored data.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["backups","package","portabase","self-hosted"],"not_affected_if":["version-1.21.2-or-later"],"how_to_check":"- Check the installed Portabase version and compare it with `1.21.2`.\n- Look for `app/api/tus/hooks/route.ts` in the deployed application and confirm it is reachable from the internet.\n- Confirm whether `/data/private/keys/master_key.bin` exists and when it was last modified.","fix":"- Upgrade Portabase to `1.21.2` or later.","status":"open","published_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","triaged_at":"2026-11-11T22:30:56+00:00","updated_at":"2026-11-11T22:30:56+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-11-11T22:30:56Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Portabase to `1.21.2` or later.","reach":"internet","title":"Portabase: unauthenticated path traversal lets attackers overwrite the master encryption key","impact":"high","summary":"Portabase is a database backup and restore tool. A path traversal in its TUS upload webhook handler lets an unauthenticated attacker overwrite arbitrary files in the private data directory, including the AES-256-GCM master key used to protect stored data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["portabase","self-hosted","backups"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"Attacker overwrites the master key, exposing all encrypted backup data and secrets","analyst_note":"","how_to_check":"- Check the installed Portabase version and compare it with `1.21.2`.\n- Look for `app/api/tus/hooks/route.ts` in the deployed application and confirm it is reachable from the internet.\n- Confirm whether `/data/private/keys/master_key.bin` exists and when it was last modified.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["version-1.21.2-or-later"],"who_is_affected":"Teams that self-host Portabase with its TUS upload endpoint reachable over the network are exposed, since the flaw needs no login. Instances on a version below 1.21.2 are the ones to look at; the sources do not say whether managed hosting is affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000753,"input_tokens":4706,"output_tokens":564,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-256':56B,118C '-67449':14A,17A '/data/private/keys/master_key.bin':115C '1.21.2':90C,129C 'ae':55B,117C 'allow':101C 'app/api/tus/hooks/route.ts':100C 'arbitrari':46B,107C 'attack':6A,44B,104C 'backup':18B,28B,69C 'cve':12A,15A 'data':51B,64B,112C 'databas':27B,68C 'directori':52B,113C 'docker':85C 'encrypt':10A 'file':47B,83C,108C 'firebird':78C 'gcm':57B,119C 'handler':40B,99C 'host':23B 'includ':53B,114C 'issu':123C 'key':11A,59B,121C 'let':5A,41B 'mariadb':77C 'master':9A,58B,120C 'mongodb':81C 'mssql':76C 'mysql':75C 'overwrit':7A,45B,106C 'packag':19B 'patch':126C 'path':3A,33B,92C 'portabas':1A,20B,24B,65C 'postgresql':74C 'prior':87C 'privat':50B,111C 'protect':62B 'redi':82C 'restor':30B,71C 'self':22B 'self-host':21B 'sql':79C 'sqlite':80C 'store':63B 'tool':31B,72C 'travers':4A,34B,93C 'tus':37B,96C 'unauthent':2A,43B,103C 'upload':38B,97C 'use':60B 'version':89C,128C 'volum':86C 'webhook':39B,98C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host Portabase with its TUS upload endpoint reachable over the network are exposed, since the flaw needs no login. Instances on a version below 1.21.2 are the ones to look at; the sources do not say whether managed hosting is affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["backups","critical","package","portabase","selfhosted"],"campaign_type":null,"search_a":"'-2026':13A,16A '-67449':14A,17A 'attack':6A 'cve':12A,15A 'encrypt':10A 'key':11A 'let':5A 'master':9A 'overwrit':7A 'path':3A 'portabas':1A 'travers':4A 'unauthent':2A","search_b":"'-256':56B 'ae':55B 'arbitrari':46B 'attack':44B 'backup':18B,28B 'data':51B,64B 'databas':27B 'directori':52B 'file':47B 'gcm':57B 'handler':40B 'host':23B 'includ':53B 'key':59B 'let':41B 'master':58B 'overwrit':45B 'packag':19B 'path':33B 'portabas':20B,24B 'privat':50B 'protect':62B 'restor':30B 'self':22B 'self-host':21B 'store':63B 'tool':31B 'travers':34B 'tus':37B 'unauthent':43B 'upload':38B 'use':60B 'webhook':39B","search_c":"'-256':118C '/data/private/keys/master_key.bin':115C '1.21.2':90C,129C 'ae':117C 'allow':101C 'app/api/tus/hooks/route.ts':100C 'arbitrari':107C 'attack':104C 'backup':69C 'data':112C 'databas':68C 'directori':113C 'docker':85C 'file':83C,108C 'firebird':78C 'gcm':119C 'handler':99C 'includ':114C 'issu':123C 'key':121C 'mariadb':77C 'master':120C 'mongodb':81C 'mssql':76C 'mysql':75C 'overwrit':106C 'patch':126C 'path':92C 'portabas':65C 'postgresql':74C 'prior':87C 'privat':111C 'redi':82C 'restor':71C 'sql':79C 'sqlite':80C 'tool':72C 'travers':93C 'tus':96C 'unauthent':103C 'upload':97C 'version':89C,128C 'volum':86C 'webhook':98C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-04T13:40:26+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-67449","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-67449","severity":null,"published_at":"2026-11-11T22:17:28+00:00","modified_at":"2026-11-11T22:17:28+00:00","first_seen_at":"2026-11-11T22:29:34+00:00","fetched_at":"2026-11-11T22:29:34+00:00","note":null}],"documents":[{"id":129428,"url":"https://github.com/Portabase/portabase/commit/8dcb406790728fbdbf758ec88bf000af79498fc1","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":129429,"url":"https://github.com/Portabase/portabase/releases/tag/1.21.2","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":129430,"url":"https://github.com/Portabase/portabase/security/advisories/GHSA-7697-vf3j-253j","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-07-04T13:40:26+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}