CVE-2026-64825 in Home Assistant
Summary
by MITRE • 07/21/2026
Home Assistant Core before 2026.6.0 contains a path traversal vulnerability that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem by uploading a crafted backup archive during the initial onboarding window. Attackers can manipulate the 'name' field inside the uploaded archive's backup.json to supply an absolute path, causing pathlib.Path.__truediv__ to discard the configured backup directory prefix and write attacker-controlled content to arbitrary locations, with full filesystem access when the process runs as root.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/21/2026
This vulnerability exists within Home Assistant Core versions prior to 2026.6.0 and represents a critical path traversal flaw that enables unauthenticated remote attackers to execute arbitrary file operations on affected systems. The vulnerability specifically manifests during the initial onboarding process when the system accepts backup archives for import, creating an attack window where malicious actors can manipulate filesystem paths without authentication requirements.
The technical implementation of this vulnerability relies on improper input validation within the backup restoration mechanism. When a backup archive is uploaded, the system parses the backup.json file contained within the archive to determine the backup name field. Attackers can craft this field to include absolute paths that bypass the intended backup directory restrictions. The core flaw occurs in how pathlib.Path._truediv_ handles path construction, where it discards the configured backup directory prefix when processing attacker-controlled absolute paths, effectively allowing arbitrary filesystem write operations.
The operational impact of this vulnerability is severe and potentially catastrophic for affected systems. Since the vulnerability allows attackers to write files anywhere on the host filesystem, they can potentially overwrite critical system binaries, modify configuration files, install persistent backdoors, or create malicious scripts that execute with the privileges of the Home Assistant process. When the process runs with root privileges, the attacker gains complete system compromise capabilities, enabling full lateral movement and persistence within the network environment.
This vulnerability maps directly to CWE-22 Path Traversal and aligns with several ATT&CK techniques including T1059 Command and Scripting Interpreter for execution, T1078 Valid Accounts for privilege escalation, and T1486 Data Encrypted for Impact. The attack surface is particularly concerning as it occurs during the initial onboarding phase when systems are typically less protected and administrators may be unaware of active threats.
Mitigation strategies should prioritize immediate upgrade to Home Assistant Core version 2026.6.0 or later, which addresses this vulnerability through proper input sanitization and path validation mechanisms. Organizations should also implement network segmentation to limit access to Home Assistant systems during the onboarding phase, disable unnecessary backup restoration functionality when not required, and monitor filesystem changes for suspicious activity. Additionally, privileged access controls should be enforced to prevent execution of the Home Assistant process with root privileges where possible, reducing the potential impact of successful exploitation.