CVE-2026-32637: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in velero-io velero

Velero, an open source Kubernetes backup and restore tool, has a path traversal vulnerability (CWE-22) identified as CVE-2026-32637. Before version 1.18.1, an attacker with control over the backup object-storage backend can craft a malicious backup tarball containing parent-directory references. When Velero restores from this tarball, it may extract files outside the intended directory, overwriting sensitive files within the pod filesystem. This vulnerability is resolved in version 1.18.1.

An attacker who compromises the backup object-storage backend can exploit this vulnerability to overwrite sensitive files in the Velero pod filesystem during a restore operation. This could lead to unauthorized modification or disruption of Velero's operation or potentially escalate to further compromise depending on the overwritten files. The CVSS 4.0 score is 5.9 (medium severity), reflecting network attack vector with low complexity but requiring user interaction and partial impact on confidentiality and integrity.

Upgrade Velero to version 1.18.1 or later, where this path traversal vulnerability is fixed. No other mitigation or temporary workaround is indicated. Since this is not a cloud service, remediation depends on user upgrade.