velero-io vulnerabilities and threats

Velero versions prior to 1.18.1 contain a path traversal vulnerability (CWE-22) that allows an attacker who controls the backup object-storage backend to upload a malicious backup tarball. This tarball can include parent-directory paths that escape the intended extraction directory during restore, potentially overwriting sensitive files in the Velero pod filesystem. The issue is fixed in Velero version 1.18.1.