Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding
Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.truediv to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.
Software afectado
Haz clic en una tecnología para ver todas sus vulnerabilidades.
| Plataforma | Paquete | Versiones vulnerables | Corregida en |
|---|---|---|---|
| Python (PyPI) | homeassistant | < 2026.6.0 | 2026.6.0 |
Referencias
- https://nvd.nist.gov/vuln/detail/CVE-2026-64825
- https://github.com/home-assistant/core/pull/172368
- https://github.com/home-assistant/core/commit/567fe858289876b68b8162a77bd46e1e1af79752
- https://github.com/home-assistant/core
- https://github.com/home-assistant/core/releases/tag/2026.6.0
- https://www.vulncheck.com/advisories/home-assistant-core-path-traversal-file-write-via-backup-upload
- https://pypi.org/project/homeassistant
- https://github.com/advisories/GHSA-5hxg-r395-fqxx
- Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:L- Debilidad (CWE)
CWE-22- Plataforma
- Python (PyPI)
- Paquete
homeassistant- Publicada
- 21.07.2026
- Actualizado
- 11.10.2026 14:19
Fuentes y licencias
OSV / GitHub Advisory Database - PYSEC-2026-3669 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-5hxg-r395-fqxx - CC BY 4.0
Historial de vulnerabilidades: homeassistant
Todas las vulnerabilidades publicadas de este paquete (Python (PyPI)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.
- Entradas en total
- 12
- Primera → última
- 09.2019 09.2026
- Sin corrección
- 0
- Explotada en ataques
- 0
Distribución por gravedad
- Crítica 2
- Alta 4
- Media 4
- Baja 2
Divulgaciones por año
- 2019: 1
- 2020: 0
- 2021: 0
- 2022: 0
- 2023: 2
- 2024: 0
- 2025: 3
- 2026: 6
-
Home Assistant Core vulnerable to Path Traversal via backup upload during onboarding esta entrada
Identifica las vulnerabilidades de tu aplicación
Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.