CyberRota Analysis
AI-GeneratedHome Assistant Core versions prior to 2026.7.0 are vulnerable to a path traversal flaw in the backup-restore function, allowing attackers to exploit crafted tar archives to write files to arbitrary locations on the filesystem. This vulnerability can lead to remote code execution, particularly since the Home Assistant process runs as root within the official Docker image, enabling attackers to overwrite critical Python paths. Organizations using affected versions of Home Assistant in Docker environments should prioritize immediate patching to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Home Assistant Core before 2026.7.0 contains a path traversal vulnerability in the backup-restore function that allows attackers to write files to arbitrary absolute filesystem paths by supplying a crafted tar archive with a SYMTYPE entry containing a benign member name paired with an absolute linkname pointing outside the extraction directory. Because the official Docker image runs the Home Assistant process as root and the subsequent regular-file entry is written through the unvalidated symlink, attackers can achieve remote code execution by overwriting auto-imported Python paths such as site-packages/sitecustomize.py or custom component directories.