{"affected":[{"product":"portabase","source":"CNA: GitHub_M","vendor":"Portabase","versions":[{"status":"affected","version":"< 1.21.2"}]}],"cveId":"CVE-2026-67449","cwes":["CWE-22","CWE-306"],"description":"Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/master_key.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":9.8,"severity":"critical","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1794433883105,"publishedAt":1794433883105,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/Portabase/portabase/security/advisories/GHSA-7697-vf3j-253j"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Portabase/portabase/pull/355"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Portabase/portabase/commit/8dcb406790728fbdbf758ec88bf000af79498fc1"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/Portabase/portabase/releases/tag/1.21.2"}],"remediation":[],"revision":"b94f333f073e782cd200954abc2e4a760a3fb738710ec94ca02fbb01bc5cccb9","sources":[{"modifiedAt":1794433883105,"name":"CNA: GitHub_M","retrievedAt":1794435074415,"url":"https://www.cve.org/CVERecord?id=CVE-2026-67449"}],"ssvc":null,"status":"published","title":"Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key","updatedAt":1794435074415}