Dashboard / CVE-2026-124029

CVE-2026-124029

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 54/100
Published: 2026-11-06 Modified: 2026-11-12 First seen: 2026-11-06 Status: active

Attack Surface

Network Low Complexity Integ. Impact

CVSS Vector Breakdown

AV: Network
AC: Low
PR: Low
UI: Passive
S: X
AT: None
VC: None
VI: High
VA: None

Description

Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. Attackers can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
kopia kopia 0
kopia kopia 0

References & Advisories (4)

Bug Bounty Relevance

54 / 100
✓ Network accessible
✓ Low complexity

CVSS Score

6.9 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.27%
Raw Score 0.002670
Percentile 19.1%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00267
2026-11-12
0.00267
2026-11-10
0.00267
2026-11-09
0.00267
2026-11-08
0.00267
2026-11-07
0.00267

Intelligence Sources

mitre ref →
nvd ref →

External Links