CVE-2026-64825
Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.__truediv__ to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.
- Affected products
- Home Assistant Core
- Fix
- Available
- CVSS 3.1
- 9.3 CRITICAL
- EPSS
- 0.5% (39th percentile)
- Weakness
- CWE-22
- NVD status
- Deferred
- Published
- 2026-07-21
No indexed exploits for CVE-2026-64825 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-64825 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.