ALPINE-CVE-2026-62268

    Dashboard / Vulnerabilities / ALPINE-CVE-2026-62268

    ALPINE-CVE-2026-62268

    Published: 5 Nov 2026Last Modified: 6 Nov 2026
    Upstream:
    CVE-2026-62268

    Summary:

    Details: borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22.

    References: https://security.alpinelinux.org/vuln/CVE-2026-62268

    Affected packages

    Package

    Name: borgbackup

    Purl: pkg:apk/alpine/borgbackup?arch=source

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.4.5-r0

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    ALPINE-CVE-2026-62268 | CVE-DB