https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-18T00:22:33.490147+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cleanstart-2026-zm91804 CLEANSTART-2026-ZM91804 — Security fix for CVE-2026-32637 applied in: velero-plugin-for-aws 1.11.1-r9, velero-plugin-for-aws 1.13.2-r6, velero-pl… 2026-10-18T00:22:33.492870+00:00

Affected: CleanStart: velero-plugin-for-aws

CVE-2026-32637 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-361477 EUVD-2026-361477 2026-10-18T00:22:33.492930+00:00 EUVD-2026-361477 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32637 fkie_cve-2026-32637 2026-10-18T00:22:33.492946+00:00

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

 https://cve.radiocsirt.org/vuln/ghsa-j2g6-362q-6qc6 GHSA-j2g6-362q-6qc6 — Velero vulnerable to file path traversal when extracting from backup's tarball 2026-10-18T00:22:33.492971+00:00

Affected: Go: github.com/vmware-tanzu/velero

### Impact _What kind of vulnerability is it? Who is impacted?_ If the attacker compromises the backup's object storage backend and uploads a malicious backup tarball including file names like the following: * ../../../tmp/escape_1 -> file created at /tmp/escape_1 * ../../../../../../../../tmp/escape_2 -> file created at /tmp/escape_2 * ../../../tmp/cron_poc -> would be /etc/cron.d/backdoor in real attack * ../../../tmp/ssh_poc -> would be ~/.ssh/authorized_keys * ../../../tmp/kubeconfig_poc -> would be ~/.kube/config

It's possible that extracting files from the tarball during restore can overwrite sensitive files in the Velero pod filesystem.

### Patches _Has the problem been patched? What versions should users upgrade to?_

By far, there is no patch yet. We are working on the main branch, then cherry-pick to the release-1.18 for v1.18.1 patch.

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

There is no workaround, but the good news is that keeping your OSS safe will prevent the vulnerability.