CVE-2026-64825: Home Assistant Path Traversal Vulnerability

CVE-2026-64825 Overview

CVE-2026-64825 is a path traversal vulnerability [CWE-22] in Home Assistant Core versions before 2026.6.0. The flaw allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem during the initial onboarding window. Attackers exploit the issue by uploading a crafted backup archive containing a manipulated name field inside backup.json. When the archive is processed, pathlib.Path.__truediv__ discards the configured backup directory prefix because the supplied name is an absolute path. The result is attacker-controlled file writes anywhere the Home Assistant process can reach, including full filesystem access when the process runs as root.

Critical Impact
Unauthenticated arbitrary file write leading to remote code execution and full host compromise on Home Assistant Core deployments running as root.

Affected Products

Home Assistant Core versions prior to 2026.6.0
Home Assistant Core deployments exposing the onboarding endpoint
Home Assistant Core instances running the backup upload handler as root

Discovery Timeline

2026-07-21 - CVE-2026-64825 published to NVD
2026-07-21 - Last updated in NVD database

Technical Details for CVE-2026-64825

Vulnerability Analysis

The vulnerability resides in the Home Assistant backup component, specifically in the handler that processes uploaded backup archives during onboarding. The backup archive contains a backup.json metadata file with a name field the server uses to derive the on-disk filename. The code combines the configured backup directory with this attacker-controlled value using Python's pathlib.Path division operator. Python's pathlib semantics cause Path("/base") / "/etc/attacker" to return /etc/attacker, silently discarding the base directory. This behavior transforms a routine path join into an arbitrary write primitive available before authentication is enforced.

Root Cause

The root cause is insufficient validation of the name field extracted from an untrusted archive. The backup manager assumed the value was a safe filename and passed it directly to pathlib.Path.__truediv__. No checks rejected absolute paths, traversal sequences, or characters outside a filename allowlist before file creation.

Attack Vector

An attacker sends an HTTP POST containing a crafted tar archive to the backup upload endpoint during the onboarding window, which does not require authentication. The archive's backup.json contains a name value such as an absolute path targeting /etc/, /root/.ssh/, or a Home Assistant automation directory. When the server writes the archive contents using the derived path, it overwrites or creates files under the attacker's control. Writing to locations such as authorized_keys, systemd unit files, or Home Assistant automations yields remote code execution.

python

# Security patch in homeassistant/components/backup/backup.py
# Reject backup uploads with unsafe inner name (#172368)

 from .agent import BackupAgent, LocalBackupAgent, OnProgressCallback
 from .const import DOMAIN, LOGGER
-from .models import AgentBackup, BackupNotFound
+from .models import AgentBackup, BackupNotFound, InvalidBackupFilename
 from .util import read_backup, suggested_filename

Source: Home Assistant Core commit 567fe85

python

# Security patch in homeassistant/components/backup/manager.py
# Adds InvalidBackupFilename to the exception handler so unsafe inner names
# are rejected during read_backup() parsing.

         try:
             backup = await async_add_executor_job(read_backup, temp_file)
-        except (OSError, tarfile.TarError, json.JSONDecodeError, KeyError) as err:
+        except (
+            OSError,
+            tarfile.TarError,
+            json.JSONDecodeError,
+            KeyError,
+            InvalidBackupFilename,
+        ) as err:
             LOGGER.warning("Unable to parse backup %s: %s", temp_file, err)
             raise

Source: Home Assistant Core commit 567fe85

Detection Methods for CVE-2026-64825

Indicators of Compromise

Unexpected files written outside the configured Home Assistant backup directory, particularly in system paths such as /etc/, /root/, or /config/automations/.
HTTP POST requests to backup or onboarding upload endpoints from unauthenticated sources during or after the onboarding window.
Backup archives on disk containing a backup.json where the name field is an absolute path or contains traversal sequences.
New or modified SSH authorized_keys, systemd unit files, or Home Assistant automation YAML created by the Home Assistant process user.

Detection Strategies

Inspect Home Assistant logs for Unable to parse backup warnings referencing InvalidBackupFilename after applying the patch, indicating exploitation attempts.
Monitor filesystem events from the Home Assistant process for writes outside the configured backup directory using auditd or eBPF-based sensors.
Alert on backup archive parsing where the extracted name field begins with / or contains .. segments.

Monitoring Recommendations

Track network access to onboarding and backup upload endpoints and correlate with the Home Assistant instance state to detect requests after onboarding should have completed.
Baseline the file ownership and paths written by the Home Assistant service account, then alert on deviations from that baseline.
Forward Home Assistant application logs and host telemetry to a centralized data lake for correlation with authentication and network events.

How to Mitigate CVE-2026-64825

Immediate Actions Required

Upgrade Home Assistant Core to version 2026.6.0 or later without delay.
Restrict network access to the Home Assistant management interface so only trusted networks can reach the onboarding and backup upload endpoints.
Complete the initial onboarding process on new installations immediately after deployment to close the unauthenticated window.
Audit the host for unexpected files written by the Home Assistant process user since the deployment date.

Patch Information

The fix is delivered in Home Assistant Core 2026.6.0. The patch introduces an InvalidBackupFilename exception and validates the inner name field of uploaded backups before performing any path operations. Details are available in the Home Assistant Core 2026.6.0 release notes, the pull request #172368, and the VulnCheck advisory.

Workarounds

Do not expose the Home Assistant onboarding endpoint to untrusted networks; place the service behind a VPN or reverse proxy with authentication until patched.
Run the Home Assistant Core process as a non-root user with a restricted filesystem view to limit the impact of arbitrary file writes.
Disable or block the backup upload endpoint at a reverse proxy layer until the upgrade to 2026.6.0 is completed.

bash

# Example: block backup upload endpoint at nginx until patched
location /api/backup/upload {
    deny all;
    return 403;
}

# Verify the installed Home Assistant Core version
hass --version