vulnerability / NVI-00011771 / Revision 1
borg extract might modify out-of-tree files when extracting maliciously crafted archives
GitHub lists this reviewed advisory for borgbackup, borgbackup. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.
This report has not inspected your inventory, configuration, deployed build, reachability or evidence. A catalog listing and a severity score do not establish exposure or compromise.
01 / Meaning
Why it matters
Published affected context helps an owner decide what evidence to gather. This report has not examined your application.
02 / Applicability
The affected context
Affected versions, configuration prerequisites and known exclusions are public. Confirm each one against the deployed service.
borgbackup
source listed< 1.4.5
### Impact A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd"). When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory. In a quite similar scenario, a crafted archive could contain a slave hardlink item with the hardlink source pointing outside the extraction directory. When extracting such an item, borg would hard-link the outside and the inside item. Note: that sounds bad, but it is no big issue in practice: to create such a malicious archive, the attacker would need repository access and (for encrypted or authenticated repos) also the borg key and passphrase. Affected: likely all borg releases before 1.4.5 (and also all borg 2.0.0 betas before b22). ### Patches - 1.4.x release series: fix released with 1.4.5. commits 3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f and 141888f2fabcd57a300547c2aa63212cb213924d. - 1.2.x release series: no new releases any more, fix commits available on 1.2-maint branch: 0ac568e290518c3bbe781459978720dde7fab224 and d907f2cb5
borgbackup
source listed>= 2.0.0b1, < 2.0.0b22
### Impact A maliciously crafted archive could contain a symlink (e.g. "evil" -> "/etc") followed by an item below it ("evil/passwd"), or an item whose path embeds ".." (e.g. "a/../../etc/passwd"). When extracting such items, borg followed the symlink / resolved the "..", so it could delete or overwrite files outside the extraction directory. In a quite similar scenario, a crafted archive could contain a slave hardlink item with the hardlink source pointing outside the extraction directory. When extracting such an item, borg would hard-link the outside and the inside item. Note: that sounds bad, but it is no big issue in practice: to create such a malicious archive, the attacker would need repository access and (for encrypted or authenticated repos) also the borg key and passphrase. Affected: likely all borg releases before 1.4.5 (and also all borg 2.0.0 betas before b22). ### Patches - 1.4.x release series: fix released with 1.4.5. commits 3e9ed6d1ad6d3531b39c07b8ef3ecf41fce4437f and 141888f2fabcd57a300547c2aa63212cb213924d. - 1.2.x release series: no new releases any more, fix commits available on 1.2-maint branch: 0ac568e290518c3bbe781459978720dde7fab224 and d907f2cb5
03 / Response
What to do next
- investigate
Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.
Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system. GitHub Advisory Database
A fixed release is not deployment evidence.
Check current vendor support and compatibility. After making a change, verify the deployed build and relevant runtime conditions. Keep the evidence, owner and time. An updated lockfile alone does not prove what is running.
04 / Limits
What this report cannot establish
- Customer inventory, deployment, reachability and exploitation have not been inspected.
05 / Provenance
Sources you can inspect
Each assertion retains its source. Mirrored records may repeat one underlying publisher; additional links are not independent corroboration.
- GHSA-gfp8-w835-v44j ↗
GitHub Advisory Database · vendor advisory
Observed . GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.
Public revision history
Only published revisions appear here. Routine fetches do not create a material-change event.
- Revision 1 ·
First indexed by Null; source disclosure date is shown separately.