5.9

CVE-2026-32637: velero-io velero Path Traversal

CVSS: 5.9v4.0MediumDeferred
AliasesCGA-5g8x-vmmh-g8cqCGA-6fmm-v8ff-r5hwCGA-6q48-hmxv-q2rp
Published 25-08-2026Last modified 28-08-2026
Open JSON

Vulnerability summary

CVE-2026-32637 is a medium (CVSS 5.9) Path Traversal vulnerability in velero-io velero. EPSS estimates a 0.54% chance of exploitation in the next 30 days, higher than 44.8% of scored vulnerabilities.

Overall risk
24/100
0100
Low · default modelHow is this calculated?
CVSS score
5.9/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.54%
0%100%
Low · +0.03 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2026:21761-1SUSE-SU-2026:23625-1CGA-VM56-VV7P-FQ86

Timeline

  1. 25-08-2026
    PublishedVulnerability first disclosed.
  2. 28-08-2026
    Last modifiedVulnerability information updated.

Description

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the extraction directory during restore and overwrite sensitive files in the Velero pod filesystem. This issue is fixed in version 1.18.1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.54%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

+0.03 pp

From 0.51% on 21-09-2026

21-09-202621-10-2026
EPSS score
0.54%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard15 products
  • velero-plugin-for-alicloudAll versions (No fix recorded)
  • velero-plugin-for-alicloud-compatAll versions (No fix recorded)
  • velero-plugin-for-alicloud-fipsAll versions (No fix recorded)
  • velero-plugin-for-alicloud-fips-compatAll versions (No fix recorded)
  • velero-plugin-for-aws< 1.14.2-r8
Wolfi5 products
  • velero-plugin-for-aws< 1.14.2-r8
  • velero-plugin-for-aws-compat< 1.14.2-r8
  • velero-plugin-for-csiAll versions (No fix recorded)
  • velero-plugin-for-csi-compatAll versions (No fix recorded)
  • velero-plugin-for-microsoft-azure< 1.14.2-r6
Github.com/vmware-tanzu1 product
  • velero< 1.18.1
Velero-io1 product

4 vendors · 22 products

References

7 links