CVE-2026-62268— borg extract might modify out-of-tree files when extracting maliciously crafted archives

Quick assessment

Affected

borgbackup borg

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

BorgBackup 是一款开源的、支持去重、压缩及认证加密的归档工具。在 1.4.5 和 2.0.0b22 版本之前，提取恶意归档时，若归档中包含指向父目录的符号链接，或包含内嵌的".."路径组件，则可能突破提取目录的边界，导致目录外的文件被删除或覆盖。此外，攻击者可构造恶意从属硬链接，将位于提取目录之外的、由攻击者控制的源文件硬链接到恢复后的文件树中，从而泄露该文件的内容。要创建此类恶意归档，攻击者必须拥有存储库访问权限；对于已加密或启用认证的存储库，还需掌握 Borg 密钥及口令。随后，受害者需执行归档提取

CVSS 5.3 · Medium Updated Nov 06, 2026

Possible ATT&CK Techniques 2 AI

T1565.001 · Stored Data Manipulation T1565.004

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

borg extract might modify out-of-tree files when extracting maliciously crafted archives

Source: CVE Program / CVE List V5

Vulnerability Description

borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Source: CVE Program / CVE List V5

Vulnerability Type

在文件访问前对链接解析不恰当(链接跟随)

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
borgbackup	borg	< 1.4.5	-

II. Public POCs for CVE-2026-62268

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-62268

请登录查看更多情报信息。

Other References for CVE-2026-62268 (9)

https://github.com/borgbackup/borg/releases/tag/1.4.5 x_refsource_MISC
https://github.com/borgbackup/borg/releases/tag/2.0.0b22 x_refsource_MISC
https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j x_refsource_CONFIRM
https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d x_refsource_MISC
https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b x_refsource_MISC
https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f x_refsource_MISC
https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329 x_refsource_MISC
https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640 x_refsource_MISC
https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224 x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-62268

IV. Related Vulnerabilities

Same product: borg

CVE-2023-36811
Archive spoofing vulnerability in borgbackup

Same vendor: borgbackup

CVE-2023-36811
Archive spoofing vulnerability in borgbackup

Same weakness: CWE-59