PT-2026-61977 · Unknown · Home Assistant Core

Harish Kolla · CVE-2026-64824 · Published 2026-07-21 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

8.4

High

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Home Assistant Core versions prior to 2026.7.0

Description A path traversal issue exists in the backup-restore function. An attacker can write files to arbitrary absolute filesystem paths by providing a specially crafted tar archive. This is achieved using a SYMTYPE entry that pairs a benign member name with an absolute linkname pointing outside the extraction directory. Since the official Docker image executes the Home Assistant process as root, the subsequent regular-file entry is written through the unvalidated symlink. This can lead to remote code execution by overwriting auto-imported Python paths, such as site-packages/sitecustomize.py, or custom component directories.

Recommendations Update Home Assistant Core to version 2026.7.0 or later.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2026-64824

Affected Products

Home Assistant Core

References · 7

• 🔥 https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-78r8-wwqv-r299 · Exploit
• https://github.com/home-assistant/core/commit/1e457600f1093c15e1325742d03e2b76498c79c1 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-64824 · Security Note
• https://github.com/home-assistant/core/releases/tag/2026.7.0 · Note
• https://github.com/home-assistant/core/pull/172252 · Note
• https://github.com/home-assistant/core/releases/tag/2026.6.0 · Note
• https://vulncheck.com/advisories/home-assistant-core-symlink-path-traversal-rce-via-backup-restore · Note