Home Assistant Core < 2026.7.0 Symlink Path Traversal RCE via backup-restore
Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assistant process as root and the subsequent regular-file entry is written through the unvalidated symlink, attackers can achieve remote code execution by overwriting auto-imported Python paths such as site-packages/sitecustomize.py or custom component directories.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-47398US | — | — | ||
PraisonAI is a multi-agent teams system. The v4.6.32 chokepoint refactor (which patched CVE-2026-44334 / GHSA-xcmw-grxf-wjhj) added the PRAISONAI_ALLOW_LOCAL_TOOLS env-var gate to… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64824.jsonADVISORY
- https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-78r8-wwqv-r299EVIDENCE
- https://github.com/home-assistant/corePACKAGE
- https://github.com/home-assistant/core/commit/1e457600f1093c15e1325742d03e2b76498c79c1FIX
- https://github.com/home-assistant/core/pull/172252REPORT
- https://github.com/home-assistant/core/releases/tag/2026.7.0ADVISORY
- https://nvd.nist.gov/vuln/detail/CVE-2026-64824ADVISORY
- https://www.vulncheck.com/advisories/home-assistant-core-symlink-path-traversal-rce-via-backup-restoreADVISORY
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan