Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-63120— PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write

Quick assessment

Affected
Aiven-Open pghoard
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

pghoard 是一款用于 PostgreSQL 的备份守护进程及恢复工具，它将备份数据存储于云对象存储（如 Amazon S3、Google Cloud Storage 或 Azure Blob Storage）。在 2.7.2 版本之前，pghoard 中存在一个不完整的路径遍历修复漏洞。若攻击者拥有对备份对象存储的写入权限，该漏洞可被利用，在指定的 PostgreSQL 数据目录（pgdata）之外执行任意文件写入和目录创建操作。当数据库管理员执行恢复操作（通过 命令）时，一个经过恶意构造、包含路径遍历序列（

CVSS 8.4 · High

Affected Version Matrix 1

VendorProduct Version RangeStatus
Aiven-Open pghoard < 2.7.2 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-63120

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
PGHoard: Incomplete Path Traversal fix in restore.py allows Arbitrary File Write
Source: CVE Program / CVE List V5
Vulnerability Description
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Aiven-Open pghoard < 2.7.2 -

II. Public POCs for CVE-2026-63120

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-63120

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-63120 (1)

Vendor Pages for CVE-2026-63120 (1)

IV. Related Vulnerabilities

Same product: pghoard
Same vendor: Aiven-Open
Same weakness: CWE-22

V. Comments for CVE-2026-63120

No comments yet

Leave a comment