{"affected":[{"product":"borg","source":"CNA: GitHub_M","vendor":"borgbackup","versions":[{"status":"affected","version":"< 1.4.5"},{"status":"affected","version":">= 2.0.0b1, < 2.0.0b22"}]},{"ecosystem":"pip","packageName":"borgbackup","product":"borgbackup","source":"GitHub GHSA-gfp8-w835-v44j","vendor":"","versions":[{"status":"affected","version":"< 1.4.5","versionType":"GitHub advisory range"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"borgbackup","product":"borgbackup","source":"OSV GHSA-gfp8-w835-v44j","vendor":"","versions":[{"status":"affected","version":"0.23.0","versionType":"PyPI"},{"status":"affected","version":"0.24.0","versionType":"PyPI"},{"status":"affected","version":"0.25.0","versionType":"PyPI"},{"status":"affected","version":"0.26.0","versionType":"PyPI"},{"status":"affected","version":"0.26.1","versionType":"PyPI"},{"status":"affected","version":"0.27.0","versionType":"PyPI"},{"status":"affected","version":"0.28.0","versionType":"PyPI"},{"status":"affected","version":"0.28.1","versionType":"PyPI"},{"status":"affected","version":"0.28.2","versionType":"PyPI"},{"status":"affected","version":"0.29.0","versionType":"PyPI"},{"status":"affected","version":"0.30.0","versionType":"PyPI"},{"status":"affected","version":"0.30.1","versionType":"PyPI"},{"status":"affected","version":"1.0.0","versionType":"PyPI"},{"status":"affected","version":"1.0.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.0.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.0.1","versionType":"PyPI"},{"status":"affected","version":"1.0.10","versionType":"PyPI"},{"status":"affected","version":"1.0.10rc1","versionType":"PyPI"},{"status":"affected","version":"1.0.11","versionType":"PyPI"},{"status":"affected","version":"1.0.11rc1","versionType":"PyPI"},{"status":"affected","version":"1.0.12","versionType":"PyPI"},{"status":"affected","version":"1.0.13","versionType":"PyPI"},{"status":"affected","version":"1.0.2","versionType":"PyPI"},{"status":"affected","version":"1.0.3","versionType":"PyPI"},{"status":"affected","version":"1.0.4","versionType":"PyPI"},{"status":"affected","version":"1.0.5","versionType":"PyPI"},{"status":"affected","version":"1.0.6","versionType":"PyPI"},{"status":"affected","version":"1.0.6rc1","versionType":"PyPI"},{"status":"affected","version":"1.0.7","versionType":"PyPI"},{"status":"affected","version":"1.0.7rc1","versionType":"PyPI"},{"status":"affected","version":"1.0.7rc2","versionType":"PyPI"},{"status":"affected","version":"1.0.8","versionType":"PyPI"},{"status":"affected","version":"1.0.8rc1","versionType":"PyPI"},{"status":"affected","version":"1.0.9","versionType":"PyPI"},{"status":"affected","version":"1.0.9rc1","versionType":"PyPI"},{"status":"affected","version":"1.1.0","versionType":"PyPI"},{"status":"affected","version":"1.1.0b1","versionType":"PyPI"},{"status":"affected","version":"1.1.0b2","versionType":"PyPI"},{"status":"affected","version":"1.1.0b3","versionType":"PyPI"},{"status":"affected","version":"1.1.0b4","versionType":"PyPI"},{"status":"affected","version":"1.1.0b5","versionType":"PyPI"},{"status":"affected","version":"1.1.0b6","versionType":"PyPI"},{"status":"affected","version":"1.1.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.1.0rc2","versionType":"PyPI"},{"status":"affected","version":"1.1.0rc3","versionType":"PyPI"},{"status":"affected","version":"1.1.0rc4","versionType":"PyPI"},{"status":"affected","version":"1.1.1","versionType":"PyPI"},{"status":"affected","version":"1.1.10","versionType":"PyPI"},{"status":"affected","version":"1.1.11","versionType":"PyPI"},{"status":"affected","version":"1.1.12","versionType":"PyPI"},{"status":"affected","version":"1.1.13","versionType":"PyPI"},{"status":"affected","version":"1.1.14","versionType":"PyPI"},{"status":"affected","version":"1.1.15","versionType":"PyPI"},{"status":"affected","version":"1.1.16","versionType":"PyPI"},{"status":"affected","version":"1.1.17","versionType":"PyPI"},{"status":"affected","version":"1.1.18","versionType":"PyPI"},{"status":"affected","version":"1.1.2","versionType":"PyPI"},{"status":"affected","version":"1.1.3","versionType":"PyPI"},{"status":"affected","version":"1.1.4","versionType":"PyPI"},{"status":"affected","version":"1.1.5","versionType":"PyPI"},{"status":"affected","version":"1.1.6","versionType":"PyPI"},{"status":"affected","version":"1.1.7","versionType":"PyPI"},{"status":"affected","version":"1.1.8","versionType":"PyPI"},{"status":"affected","version":"1.1.9","versionType":"PyPI"},{"status":"affected","version":"1.2.0","versionType":"PyPI"},{"status":"affected","version":"1.2.0a2","versionType":"PyPI"},{"status":"affected","version":"1.2.0a3","versionType":"PyPI"},{"status":"affected","version":"1.2.0a4","versionType":"PyPI"},{"status":"affected","version":"1.2.0a5","versionType":"PyPI"},{"status":"affected","version":"1.2.0a6","versionType":"PyPI"},{"status":"affected","version":"1.2.0a7","versionType":"PyPI"},{"status":"affected","version":"1.2.0a8","versionType":"PyPI"},{"status":"affected","version":"1.2.0a9","versionType":"PyPI"},{"status":"affected","version":"1.2.0b1","versionType":"PyPI"},{"status":"affected","version":"1.2.0b2","versionType":"PyPI"},{"status":"affected","version":"1.2.0b3","versionType":"PyPI"},{"status":"affected","version":"1.2.0b4","versionType":"PyPI"},{"status":"affected","version":"1.2.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.2.1","versionType":"PyPI"},{"status":"affected","version":"1.2.2","versionType":"PyPI"},{"status":"affected","version":"1.2.3","versionType":"PyPI"},{"status":"affected","version":"1.2.4","versionType":"PyPI"},{"status":"affected","version":"1.2.5","versionType":"PyPI"},{"status":"affected","version":"1.2.6","versionType":"PyPI"},{"status":"affected","version":"1.2.7","versionType":"PyPI"},{"status":"affected","version":"1.2.8","versionType":"PyPI"},{"status":"affected","version":"1.2.9","versionType":"PyPI"},{"status":"affected","version":"1.3.0a1","versionType":"PyPI"},{"status":"affected","version":"1.4.0","versionType":"PyPI"},{"status":"affected","version":"1.4.0a1","versionType":"PyPI"},{"status":"affected","version":"1.4.0b1","versionType":"PyPI"},{"status":"affected","version":"1.4.0b2","versionType":"PyPI"},{"status":"affected","version":"1.4.0rc1","versionType":"PyPI"},{"status":"affected","version":"1.4.1","versionType":"PyPI"},{"status":"affected","version":"1.4.2","versionType":"PyPI"},{"status":"affected","version":"1.4.3","versionType":"PyPI"},{"status":"affected","version":"1.4.4","versionType":"PyPI"},{"events":[{"introduced":"0"},{"fixed":"1.4.5"}],"status":"unknown","version":"0","versionType":"ECOSYSTEM"}]},{"defaultStatus":"unaffected","ecosystem":"PyPI","packageName":"borgbackup","product":"borgbackup","source":"OSV GHSA-gfp8-w835-v44j","vendor":"","versions":[{"status":"affected","version":"2.0.0b1","versionType":"PyPI"},{"status":"affected","version":"2.0.0b10","versionType":"PyPI"},{"status":"affected","version":"2.0.0b11","versionType":"PyPI"},{"status":"affected","version":"2.0.0b12","versionType":"PyPI"},{"status":"affected","version":"2.0.0b13","versionType":"PyPI"},{"status":"affected","version":"2.0.0b14","versionType":"PyPI"},{"status":"affected","version":"2.0.0b15","versionType":"PyPI"},{"status":"affected","version":"2.0.0b16","versionType":"PyPI"},{"status":"affected","version":"2.0.0b17","versionType":"PyPI"},{"status":"affected","version":"2.0.0b18","versionType":"PyPI"},{"status":"affected","version":"2.0.0b19","versionType":"PyPI"},{"status":"affected","version":"2.0.0b2","versionType":"PyPI"},{"status":"affected","version":"2.0.0b20","versionType":"PyPI"},{"status":"affected","version":"2.0.0b21","versionType":"PyPI"},{"status":"affected","version":"2.0.0b3","versionType":"PyPI"},{"status":"affected","version":"2.0.0b4","versionType":"PyPI"},{"status":"affected","version":"2.0.0b5","versionType":"PyPI"},{"status":"affected","version":"2.0.0b6","versionType":"PyPI"},{"status":"affected","version":"2.0.0b7","versionType":"PyPI"},{"status":"affected","version":"2.0.0b8","versionType":"PyPI"},{"status":"affected","version":"2.0.0b9","versionType":"PyPI"},{"events":[{"introduced":"2.0.0b1"},{"fixed":"2.0.0b22"}],"status":"unknown","version":"2.0.0b1","versionType":"ECOSYSTEM"}]}],"cveId":"CVE-2026-62268","cwes":["CWE-59"],"description":"borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22.","epss":{"date":"2026-11-09","percentile":0.05027,"score":0.00159},"exploits":[],"kev":null,"metrics":[{"score":5.3,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":5.3,"severity":"medium","source":"NVD: security-advisories@github.com","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","version":"4.0"}],"modifiedAt":1794266244050,"publishedAt":1793910528031,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/borgbackup/borg/releases/tag/1.4.5"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/borgbackup/borg/releases/tag/2.0.0b22"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/commit/0ac568e290518c3bbe781459978720dde7fab224"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/commit/141888f2fabcd57a300547c2aa63212cb213924d"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/commit/2d632531028b09da8ab5d1450f89bebcc205d640"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/commit/3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/commit/4f37fdfed10b50559a0dd333b0d5581c642af329"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/commit/d907f2cb57337041c4fa55ca4682895535e5076b"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/releases/tag/1.4.5"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/releases/tag/2.0.0b22"},{"source":"security-advisories@github.com","tags":[],"url":"https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"},{"source":"GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-gfp8-w835-v44j"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-gfp8-w835-v44j"}],"remediation":[{"kind":"fix","source":"GitHub GHSA-gfp8-w835-v44j","text":"borgbackup (pip): GitHub reports patched versions 1.4.5. Check the advisory for the affected release branch.","url":"https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"},{"kind":"fix","source":"OSV GHSA-gfp8-w835-v44j","text":"borgbackup (PyPI): OSV reports a fixed version 1.4.5. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-gfp8-w835-v44j"},{"kind":"fix","source":"OSV GHSA-gfp8-w835-v44j","text":"borgbackup (PyPI): OSV reports a fixed version 2.0.0b22. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-gfp8-w835-v44j"}],"revision":"6d5537de47daee2b5e46157b445643d1a452131dd5825dbb65d9140bd683838c","sources":[{"modifiedAt":1794264839897,"name":"CNA: GitHub_M","retrievedAt":1794265820949,"url":"https://www.cve.org/CVERecord?id=CVE-2026-62268"},{"modifiedAt":1794266244050,"name":"NVD","retrievedAt":1794269910588,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-62268"},{"modifiedAt":1787769645000,"name":"GitHub Security Advisories","retrievedAt":1794090309513,"url":"https://github.com/borgbackup/borg/security/advisories/GHSA-gfp8-w835-v44j"},{"modifiedAt":1792096206122,"name":"OSV / GitHub Security Advisories","retrievedAt":1793913855518,"url":"https://osv.dev/vulnerability/GHSA-gfp8-w835-v44j"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794265822464,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-62268"}],"ssvc":{"assessedAt":1794264826813,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"borg extract might modify out-of-tree files when extracting maliciously crafted archives","updatedAt":1794269910588}