VictoriaMetrics is a scalable time‑series monitoring solution. The vmrestore command fails to validate backup part path components before writing the restored data to disk. An attacker who can supply or alter backup objects in S3, GCS, Azure Blob Storage, or other cloud storage can embed ".." components in object names. When an operator restores such a backup, the crafted names cause vmrestore to create or overwrite files outside its intended restore root, thereby enabling modification of arbitrary files with the file system permissions of the vmrestore process. This can compromise the integrity of the system and potentially allow privilege escalation if the attacker can redirect the restore to critical files.

VictoriaMetrics VictoriaMetrics is affected in all releases prior to v1.122.25, v1.136.12, and v1.146.0. The vulnerability is fixed in those versions and all later releases.

The CVSS score of 6.8 places this vulnerability in the moderate range. The exploit probability (EPSS) data is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires the attacker to have the ability to manipulate the names of backup objects stored in a cloud storage service; the attack succeeds when an operator runs vmrestore against the compromised backup. The risk is therefore moderate, with exploitation possible in an environment where backup objects are not strictly controlled and can be tampered with.