CVE-2026-64824: Home Assistant Core RCE Vulnerability

CVE-2026-64824 Overview

CVE-2026-64824 is a path traversal vulnerability [CWE-22] in Home Assistant Core versions prior to 2026.7.0. The flaw resides in the backup-restore function, which extracts user-supplied tar archives without validating symbolic link targets. An attacker who supplies a crafted archive containing a SYMTYPE entry with an absolute linkname can redirect file writes to arbitrary locations on the host filesystem. Because the official Docker image runs the Home Assistant process as root, exploitation results in remote code execution by overwriting auto-imported Python files such as site-packages/sitecustomize.py or custom component directories.

Critical Impact
Attackers with backup upload privileges can write arbitrary files as root and achieve remote code execution on the Home Assistant host.

Affected Products

Home Assistant Core versions prior to 2026.7.0
Home Assistant official Docker image (process runs as root)
Deployments exposing the backup-restore endpoint to authenticated users

Discovery Timeline

2026-07-21 - CVE-2026-64824 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-64824

Vulnerability Analysis

The vulnerability exists in homeassistant/backup_restore.py, where the backup archive is extracted using Python's tarfile.extractall with filter="fully_trusted". The fully_trusted filter disables Python's built-in protections against absolute paths and symbolic link traversal. As a result, an attacker-controlled tar archive can define symlinks whose targets reference locations outside the intended extraction directory.

Exploitation follows a two-step pattern within a single archive. The attacker first stages a symlink entry whose member name appears benign but whose linkname points to an absolute filesystem path. A subsequent regular-file entry then writes through that symlink, causing the file contents to land at the attacker-chosen location. This pattern is a classic symlink-follow abuse against permissive tar extraction routines.

Root Cause

The root cause is the use of the fully_trusted extraction filter combined with insufficient validation of SYMTYPE entries. The pre-patch code called securetar.secure_path on members, but this only sanitized member names and did not inspect linkname fields for absolute paths or upward traversal. The archive was then extracted with elevated privileges under the Docker root context.

Attack Vector

An authenticated user with permission to restore backups uploads a malicious tar archive to the Home Assistant instance. During restore, the extraction routine creates the attacker's symlink and then writes a follow-up regular file through it. Writing to site-packages/sitecustomize.py guarantees code execution on the next Python interpreter start, while overwriting a custom component executes code the next time Home Assistant loads that integration.

python

# Patch diff from homeassistant/backup_restore.py
     ):
         ostf.tar.extractall(
             path=Path(tempdir, "extracted"),
-            members=securetar.secure_path(ostf.tar),
-            filter="fully_trusted",
+            filter="tar",
         )
         backup_meta_file = Path(tempdir, "extracted", "backup.json")
         backup_meta = json.loads(backup_meta_file.read_text(encoding="utf8"))
# Source: https://github.com/home-assistant/core/commit/1e457600f1093c15e1325742d03e2b76498c79c1

The fix replaces fully_trusted with the tar filter, which enforces PEP 706 safety checks, blocking absolute paths, upward traversal, and unsafe symlink targets during extraction.

Detection Methods for CVE-2026-64824

Indicators of Compromise

Presence of sitecustomize.py inside the Home Assistant Python site-packages directory when it did not previously exist.
Unexpected files or symlinks created under /usr/src/homeassistant, /config/custom_components, or system directories immediately after a backup restore.
Backup archive upload events followed by outbound network connections from the Home Assistant container to unfamiliar hosts.
New or modified __init__.py files in custom component directories with recent timestamps that do not match legitimate updates.

Detection Strategies

Inspect uploaded backup tar archives for SYMTYPE entries whose linkname field contains absolute paths or .. sequences before restore is invoked.
Monitor process lineage from the Home Assistant container for Python interpreter spawns invoking shells, network utilities, or os.system calls following restore operations.
Alert on file writes to sitecustomize.py, usercustomize.py, or any file under Python site-packages originating from the Home Assistant process.

Monitoring Recommendations

Enable filesystem integrity monitoring on custom_components/, site-packages/, and Home Assistant configuration directories.
Log all authenticated calls to the backup-restore API and correlate with subsequent file creations outside the expected extraction path.
Forward container audit logs to a centralized data lake and query for anomalous root-owned file creations following archive extraction events.

How to Mitigate CVE-2026-64824

Immediate Actions Required

Upgrade Home Assistant Core to version 2026.7.0 or later, which enforces the safe tar extraction filter.
Restrict backup-restore permissions to trusted administrators and require multi-factor authentication for those accounts.
Audit recent backup restore events for archives sourced from untrusted origins and inspect the resulting filesystem for unauthorized changes.
Reprovision any Home Assistant instance suspected of restoring an untrusted backup because root-level RCE requires container rebuild.

Patch Information

The fix is included in the Home Assistant Core 2026.7.0 release, delivered by pull request #172252 and committed in 1e457600f1093c15e1325742d03e2b76498c79c1. Refer to the VulnCheck advisory for additional context.

Workarounds

Disable the backup-restore feature or block network access to the restore endpoint until the upgrade is applied.
Run the Home Assistant container as a non-root user with a read-only root filesystem to limit the blast radius of arbitrary file writes.
Validate backup archives out-of-band using a tar inspection tool that rejects absolute or traversing symlink targets before uploading them for restore.

bash

# Verify installed Home Assistant Core version and upgrade
docker exec homeassistant python -c "import homeassistant; print(homeassistant.__version__)"
docker pull ghcr.io/home-assistant/home-assistant:2026.7.0
docker stop homeassistant && docker rm homeassistant
# Recreate the container using your existing compose or run command pinned to 2026.7.0 or later