CVE-2026-61625
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.
Risk Assessment
The risk includes overwriting or creating files outside the intended directory, potentially leading to system compromise, privilege escalation, or execution of malicious code. The attack requires the ability to modify the backup source, which may be possible remotely.
Recommendation
It is recommended to immediately upgrade to one of the fixed versions (1.122.25, 1.136.12, or 1.146.0). Also, verify the integrity of backup sources and restrict access to them.
Other vulnerabilities in VictoriaMetrics
See all- CVE-2026-19898Low
In VictoriaMetrics up to version 1.146.0, a vulnerability was found in the VMAuth Authentication Endpoint component, in the requestHandler function of app/vmauth/main.go. The issue is improper restriction of excessive authentication attempts, allowing brute-force attacks. The attack is remote but requires high complexity. Upgrading to version 1.147.0 is recommended.
- CVE-2025-65942Low
VictoriaMetrics in versions from 1.0.0 before 1.110.23, from 1.111.0 before 1.122.8, and from 1.123.0 before 1.129.1 is vulnerable to DoS attacks because the snappy decoder ignored request size limits, allowing malformed blocks to trigger excessive memory use. This could lead to OOM errors and service instability; the fix enforces block-size checks based on MaxRequest limits and is available in versions 1.110.23, 1.122.8, and 1.129.1.
Original NVD description (English source)
VictoriaMetrics is a scalable solution for monitoring and managing time series data. Prior to 1.122.25, 1.136.12, and 1.146.0, vmrestore does not validate backup part path components before using lib/backup/actions/restore.go and lib/backup/fslocal/fslocal.go to write restored data below storageDataPath. An attacker who can supply or modify an S3, GCS, Azure Blob Storage, or other backup source can place .. components in object names. When an operator restores that source, the crafted names can create or overwrite files outside the intended restore root within the filesystem permissions of the vmrestore process. This issue is fixed in versions 1.122.25, 1.136.12, and 1.146.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS