CVE-2026-64824
Home Assistant Core versions before 2026.7.0 have a path traversal flaw in the backup‑restore feature. By supplying a specially crafted tar file, an attacker can write files to any absolute location on the host system. The flaw is especially dangerous because the official Docker image runs Home Assistant as root, allowing the attacker to overwrite critical files such as sitecustomize.py or custom component directories.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Home Assistant Core prior to version 2026.7.0, particularly when run from the official Docker image that executes the process as root.
Real-world impact
An attacker can place arbitrary files on the host filesystem, including Python modules that are automatically imported. This can lead to remote code execution, allowing the attacker to take full control of the system.
Why this severity
The CVSS score of 9.3 reflects the vulnerability’s high exploitability (remote, low effort), the ability to gain high privileges (root), and the severe impact on confidentiality, integrity, and availability. The flaw permits arbitrary file writes that can compromise the entire host.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 21, 2026 · 11d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 21, 2026 · 11d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.