CVE-2026-63120: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in Aiven-Open pghoard

pghoard is a PostgreSQL backup daemon that stores backups in cloud object stores. Before version 2.7.2, an incomplete path traversal fix allows an attacker with write access to the backup storage (e.g., S3, GCS, Azure) to craft a malicious delta backup manifest containing path traversal sequences. When a database administrator runs a restore operation (pghoard_restore get-basebackup), this manifest causes arbitrary file writes and directory creation outside the designated PostgreSQL data directory (pgdata). This vulnerability is tracked as CWE-22 and has a CVSS 3.1 score of 8.4, indicating high severity. The vulnerability is fixed in version 2.7.2.

An attacker with write access to the backup object storage can cause arbitrary file writes and directory creation on the host system during restore operations. This can lead to full compromise of the host system, including confidentiality, integrity, and availability impacts as indicated by the CVSS vector (C:H/I:H/A:H).

Upgrade pghoard to version 2.7.2 or later, where the path traversal vulnerability is fixed. Since this is a cloud-hosted service component, the vendor manages remediation for the cloud service. Administrators should ensure they are running patched versions before performing restore operations.