Kopia through 0.23.1 contains a path traversal flaw in the copyDirectoryContent helper used during snapshot restores. By crafting directory manifest entries named '..', a user who can write to the repository can cause the restore process to write files outside the intended destination. The attacker can therefore overwrite existing files or create new files with arbitrary names and contents, compromising data integrity and potentially facilitating further malicious activity.

Vulnerable instances of the open-source backup tool Kopia, versions 0.23.1 and earlier, are affected. Any deployment that stores snapshots in a Kopia repository and allows multiple users to write to that repository is at risk.

The CVSS v3 score of 6.9 indicates a moderate severity vulnerability. EPSS is currently not available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires legitimate write access to the Kopia repository and the ability to trigger a restore; thus, it is most relevant to environments with shared write permissions or where snapshots are created by untrusted users. Attackers can bypass the default restore path and place arbitrary data on the victim's filesystem, potentially leading to data corruption or the placement of malicious files.