GO-2026-4570
Vitess users with backup storage access can write to arbitrary file paths in vitess.io/vitess
At a glance
- Published
- Updated
- CVE
- CVE-2026-27969
- Aliases
- GHSA-r492-hjgh-c9gw
Description
Vitess users with backup storage access can write to arbitrary file paths on restore in vitess.io/vitess
Affected packages
| Package | Versions |
|---|---|
| Go · vitess.io/vitess | introduced 0, fixed 0.22.4, introduced 0.23.0-rc1, fixed 0.23.3 |
References
- https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw ADVISORY
- https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a WEB
- https://github.com/vitessio/vitess/pull/19470 WEB
- https://owasp.org/www-community/attacks/Path_Traversal WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — Go Vulnerability Database |