CVE Intelligence
Analysis AI-assisted

CVE-2026-64825: Home Assistant Core Path Traversal File Write via Backup Upload

Home Assistant Core before 2026.6.0 has a path traversal flaw (CWE-22) in backup upload handling that can let an unauthenticated attacker write files outside the intended backup directory during the initial onboarding window. The record reports a CVSS 3.1 base score of 9.3 from VulnCheck, and the impact is greater when the process runs as root. The sources consulted do not show confirmed exploitation in the wild.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-64825 is a path traversal weakness (CWE-22) in Home Assistant Core. The record describes it as affecting versions before 2026.6.0 and as allowing file writes outside the configured backup directory through a crafted backup archive uploaded during initial onboarding.

Impact

  • The record describes arbitrary file write to locations on the host filesystem.
  • The record states that the impact is greater when the process runs as root, which is described as giving full filesystem access.
  • The VulnCheck CVSS 3.1 base score is 9.3, with the record listing high integrity impact and low availability impact. Confidentiality impact is listed as none.
  • The SSVC data in the record lists automatable as yes and technical impact as partial.

Affected products and versions

  • Product: Home Assistant Core.
  • Affected range in the record: before 2026.6.0.
  • The record names 2026.6.0 as the version that the referenced release notes and commit relate to.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. The SSVC exploitation field is none and the EPSS probability is 0.0058. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

  • Upgrade Home Assistant Core to 2026.6.0 or later, as the affected range ends before that version.
  • Review the release notes and the referenced patch commit to confirm the change set before deployment.
  • Until upgrading, limit exposure of the onboarding interface and avoid running the process with root privileges, which the record identifies as increasing impact.
  • Review whether any backup files were accepted during onboarding on exposed installations.

Detection guidance

  • Review logs and file system changes around the onboarding period for unexpected files written outside the backup directory.
  • Monitor for newly created files in sensitive system paths on hosts running Home Assistant Core.
  • Verify the installed version against the affected range.

Limitations of the available information

  • The record contains no fixed-version field; the fix version is inferred from the affected range and the release tag.
  • The record does not describe the exact conditions of the onboarding window or whether it remains open after setup.
  • The NVD status is recorded as Deferred in the source data, so the NVD entry may change.
  • No proof-of-concept or detailed exploitation information is included here by design.

Frequently asked questions

Which Home Assistant Core versions are affected by CVE-2026-64825?

The record lists Home Assistant Core versions before 2026.6.0 as affected.

Is this vulnerability known to be exploited in the wild?

The CISA KEV catalog does not list this CVE in the record, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Plan an upgrade to 2026.6.0 or later, review the referenced release notes, and reduce exposure of the onboarding interface until the upgrade is complete.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.