CVE-2026-63120
HighCVSS 8.4Exploitation Probability (EPSS)
Low risk41th percentile - higher than 41% of all known CVEs
Summary
An incomplete path traversal fix in pghoard, a PostgreSQL backup daemon, allows an attacker with write access to the backup object storage (S3, GCS, Azure) to write arbitrary files and create directories outside the PostgreSQL data directory. A malicious delta backup manifest with path traversal sequences can write arbitrary payloads to the host during a restore operation. The issue is patched in version 2.7.2.
Risk Assessment
An attacker can write arbitrary files on the host system, such as in /etc/cron.d, leading to code execution and full system compromise. The risk is high if the backup storage is not fully trusted.
Recommendation
Update pghoard to version 2.7.2 or later. Restrict write access to the backup storage and verify manifest integrity before performing restores.
Other vulnerabilities in pghoard
Original NVD description (English source)
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS