Vulnerability GO-2026-6366
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
4 hours ago
September 15, 2026 at 06:39 PM UTC
Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics
v0.1.0-victorialogs - v1.122.24
v0.1.0-victorialogs - v1.122.24
Summary
Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics
Details
Path traversal via crafted backup part names escapes restore root in github.com/VictoriaMetrics/VictoriaMetrics
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
12 days ago
VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root
v0.1.0-victorialogs - v1.122.24 and v1.123.0 - v1.136.11 and v1.137.0 - v1.146.0-cluster GHSA-8q3c-rjr9-xxrp
v0.1.0-victorialogs - v1.122.24 and v1.123.0 - v1.136.11 and v1.137.0 - v1.146.0-cluster GHSA-8q3c-rjr9-xxrp
Unknown
9 months ago
VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM in github.com/VictoriaMetrics/VictoriaMetrics
v0.1.0-victorialogs - v1.110.22 GO-2025-4161
v0.1.0-victorialogs - v1.110.22 GO-2025-4161
Low Risk
9 months ago
VictoriaMetrics' Snappy Decoder DoS Vulnerability is Causing OOM
v1.1.0-victorialogs - v1.110.22 and v1.111.0 - v1.122.7 and v1.123.0 - v1.129.1-cluster GHSA-66jq-2c23-2xh5
v1.1.0-victorialogs - v1.110.22 and v1.111.0 - v1.122.7 and v1.123.0 - v1.129.1-cluster GHSA-66jq-2c23-2xh5
Impacted packages
Timeline
Published
4 hours ago
September 15, 2026 at 06:39 PM UTC
Last Modified
4 hours ago
September 15, 2026 at 07:00 PM UTC