CVE-2026-63120 Details
Description
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores. Prior to version 2.7.2, an incomplete path traversal fix in pghoard allows an attacker with write access to the backup object storage (such as S3, GCS, or Azure) to execute arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). When a database administrator executes a restore operation (via pghoard_restore get-basebackup), a maliciously crafted delta backup manifest with path traversal sequences (e.g., ../../../../etc/cron.d/backdoor) will write arbitrary payloads to the host system. This issue has been patched in version 2.7.2.
A path traversal vulnerability has been identified in pghoard, a PostgreSQL backup and restore tool that uses cloud object storage. This vulnerability exists in versions prior to 2.7.2. It allows an attacker with write access to the backup storage (such as S3, GCS, or Azure) to execute arbitrary file writes and create directories outside the designated PostgreSQL data directory. The issue arises from an incomplete path traversal fix, which can be exploited by crafting a malicious delta backup manifest with path traversal sequences. When a database administrator performs a restore operation using pghoard, the crafted manifest can write arbitrary payloads to the host system.
Users are advised to upgrade to pghoard version 2.7.2, in which this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 23, 2026CISA-ADP
Assessed Oct 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Aiven-Open/pghoard/releases/tag/2.7.2 | [email protected] | Release NotesVendor |
| https://github.com/Aiven-Open/pghoard/security/advisories/GHSA-rh99-q79h-vvx3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Aiven-Open pghoard | <= 2.7.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 23, 2026 | CVE Modified | CISA-ADP |
| Oct 23, 2026 | New CVE Received | [email protected] |