{"id":"DEBIAN-CVE-2026-62268","details":"borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase; a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22.","modified":"2026-11-06T05:01:12.657515467Z","published":"2026-11-05T21:18:52.133Z","upstream":["CVE-2026-62268"],"references":[{"type":"ADVISORY","url":"https://security-tracker.debian.org/tracker/CVE-2026-62268"}],"affected":[{"package":{"name":"borgbackup","ecosystem":"Debian:12","purl":"pkg:deb/debian/borgbackup?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.4-1","1.2.4-2","1.2.4-3","1.2.5-1","1.2.5-2","1.2.5-3","1.2.5-4","1.2.6-1","1.2.6-2","1.2.7-1","1.2.7-2","1.2.7-2~bpo12+1","1.2.8-1","1.2.8-1~bpo12+1","1.4.0-1","1.4.0-2","1.4.0-3","1.4.0-4","1.4.0-4~bpo12+1","1.4.0-5","1.4.1-1","1.4.1-2","1.4.1-3","1.4.1-3~exp1","1.4.1-4","1.4.2-1","1.4.2-2","1.4.3-1","1.4.3-2","1.4.3-3","1.4.3-4","1.4.4-1","1.4.4-2","1.4.4-3","1.4.4-4","1.4.4-5","1.4.5-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62268.json"}},{"package":{"name":"borgbackup","ecosystem":"Debian:13","purl":"pkg:deb/debian/borgbackup?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.4.0-5","1.4.1-1","1.4.1-2","1.4.1-3","1.4.1-3~exp1","1.4.1-4","1.4.2-1","1.4.2-2","1.4.3-1","1.4.3-2","1.4.3-3","1.4.3-4","1.4.4-1","1.4.4-2","1.4.4-3","1.4.4-4","1.4.4-5","1.4.5-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62268.json"}},{"package":{"name":"borgbackup","ecosystem":"Debian:14","purl":"pkg:deb/debian/borgbackup?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.5-1"}]}],"versions":["1.4.0-5","1.4.1-1","1.4.1-2","1.4.1-3","1.4.1-3~exp1","1.4.1-4","1.4.2-1","1.4.2-2","1.4.3-1","1.4.3-2","1.4.3-3","1.4.3-4","1.4.4-1","1.4.4-2","1.4.4-3","1.4.4-4","1.4.4-5"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62268.json"}},{"package":{"name":"borgbackup2","ecosystem":"Debian:12","purl":"pkg:deb/debian/borgbackup2?arch=source&distro=bookworm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0b11-1","2.0.0b11-2","2.0.0b11-3","2.0.0b12-1","2.0.0b12-2","2.0.0b12-3","2.0.0b12-4","2.0.0b12-5","2.0.0b12-6","2.0.0b12-7","2.0.0b13-1","2.0.0b13-2","2.0.0b14-1","2.0.0b14-2","2.0.0b14-3","2.0.0b14-4","2.0.0b15-1","2.0.0b16-1","2.0.0b17-1","2.0.0b17-2","2.0.0b17-3","2.0.0b18-1","2.0.0b18-2","2.0.0b18-3","2.0.0b19-1","2.0.0b19.post2-1","2.0.0b19.post2-2","2.0.0b19.post2-3","2.0.0b20-1","2.0.0b20-2","2.0.0b20-3","2.0.0b20-4","2.0.0b20-5","2.0.0b21-1","2.0.0b22-1","2.0.0b22-2","2.0.0b23-1","2.0.0b23-2","2.0.0b23-3","2.0.0b23-4","2.0.0b23-5","2.0.0b24-1","2.0.0b24-2","2.0.0b24-3","2.0.0b24-4","2.0.0b25-1","2.0.0b25-2","2.0.0b25-3","2.0.0b25-4","2.0.0b5-1","2.0.0b5-2","2.0.0b5-3","2.0.0b7-1","2.0.0b7-2","2.0.0b8-1","2.0.0b8-2","2.0.0b9-1","2.0.0b9-2"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62268.json"}},{"package":{"name":"borgbackup2","ecosystem":"Debian:13","purl":"pkg:deb/debian/borgbackup2?arch=source&distro=trixie"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.0b19-1","2.0.0b19.post2-1","2.0.0b19.post2-2","2.0.0b19.post2-3","2.0.0b20-1","2.0.0b20-2","2.0.0b20-3","2.0.0b20-4","2.0.0b20-5","2.0.0b21-1","2.0.0b22-1","2.0.0b22-2","2.0.0b23-1","2.0.0b23-2","2.0.0b23-3","2.0.0b23-4","2.0.0b23-5","2.0.0b24-1","2.0.0b24-2","2.0.0b24-3","2.0.0b24-4","2.0.0b25-1","2.0.0b25-2","2.0.0b25-3","2.0.0b25-4"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62268.json"}},{"package":{"name":"borgbackup2","ecosystem":"Debian:14","purl":"pkg:deb/debian/borgbackup2?arch=source&distro=forky"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0b22-1"}]}],"versions":["2.0.0b19-1","2.0.0b19.post2-1","2.0.0b19.post2-2","2.0.0b19.post2-3","2.0.0b20-1","2.0.0b20-2","2.0.0b20-3","2.0.0b20-4","2.0.0b20-5","2.0.0b21-1"],"ecosystem_specific":{"urgency":"not yet assigned"},"database_specific":{"source":"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-62268.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"}]}