pghoard, a PostgreSQL backup and restore daemon, contained an incomplete path traversal fix that allowed a write‑able user to craft a delta backup manifest containing traversal sequences (e.g., ../../../../etc/cron.d/backdoor). Executing a restore with such a manifest would create or overwrite files outside the designated PostgreSQL data directory, providing an attacker the ability to place arbitrary payloads on the host. This vulnerability is a classic example of CWE‑22, where an attacker can influence file paths to target unintended locations. The impact is the potential for arbitrary file writes on the system hosting pghoard, which can lead to privilege escalation or full system compromise if the attacker can place executable payloads or modify critical configuration files.

The flaw affects Aiven Open’s pghoard implementations built prior to version 2.7.2. Any deployment that uses an earlier version and allows an attacker to write to the cloud object store (S3, GCS, Azure, or similar) is vulnerable. The patch was released in v2.7.2, fixing the path traversal handling in restore.py.

The CVSS score of 8.4 classifies the vulnerability as high severity, and the EPSS score is currently unavailable, so the estimated exploitation probability cannot be quantified. The issue is not listed in the CISA KEV catalog. Based on the description it is inferred that the attack vector requires an attacker to have write access to the backup object store used by the affected pghoard instance. With that access, they can craft a malicious manifest and trigger an arbitrary file write during a restore operation.