CVE-2026-64824 is a path traversal vulnerability in Home Assistant Core before version 2026.6.0. The vulnerability arises from improper validation of symbolic links in the backup-restore tar extraction process. An attacker can supply a tar archive containing a SYMTYPE entry with an absolute linkname outside the extraction directory. When the archive is extracted, the subsequent file entry is written through this unvalidated symlink, allowing arbitrary files to be overwritten anywhere on the filesystem. Since the official Docker container runs the Home Assistant process as root, this can be exploited to achieve remote code execution by overwriting auto-imported Python files such as site-packages/sitecustomize.py or directories for custom components.

Successful exploitation allows an attacker with access to the backup-restore function to write arbitrary files anywhere on the filesystem with root privileges in the official Docker environment. This can lead to remote code execution by overwriting critical Python import paths or custom component directories, potentially compromising the entire Home Assistant instance and underlying host system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the backup-restore functionality to trusted users only and avoid running Home Assistant Core with root privileges in Docker containers if possible.