Home Assistant Core before 2026.7.0 contains a path‑traversal flaw in its backup‑restore function. An attacker who can supply a crafted tar archive can create a symbolic link whose linkname points to an arbitrary absolute filesystem path. Because the Docker image runs the Home Assistant process as root and the unvalidated symlink is followed during extraction, the attacker can overwrite critical files such as site‑packages/sitecustomize.py or files in custom component directories that the Python interpreter loads when the service starts. This flaw is a classic CWE‑22 weakness and provides an attacker with the ability to execute arbitrary code with system privileges. Affected systems are deployments of Home Assistant Core produced by home‑assistant under the vendor name Home Assistant Core. All releases older than 2026.7.0 are vulnerable; the issue is specifically tied to the Docker image where the process runs as root. The vulnerability emerges when a backup archive is restored, either manually or automatically, using the built‑in restore functionality. The CVSS score of 9.3 reflects the high impact and full privilege escalation potential. The EPSS score is below 1%, indicating that exploitation is currently considered unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector relies on an actor who has access to the backup‑restore feature—typically a trusted administrator or a user with sufficient privileges—to supply a malicious archive that triggers the symlink traversal during restoration. Successful exploitation results in remote code execution with root privileges on the host running the Docker container.

Affected systems are deployments of Home Assistant Core produced by home‑assistant under the vendor name Home Assistant Core. All releases older than 2026.7.0 are vulnerable; the issue is specifically tied to the Docker image where the process runs as root. The vulnerability emerges when a backup archive is restored, either manually or automatically, using the built‑in restore functionality.

The CVSS score of 9.3 reflects the high impact and full privilege escalation potential. The EPSS score is below 1%, indicating that exploitation is currently considered unlikely but not impossible. The vulnerability is not listed in CISA’s KEV catalog. The most probable attack vector relies on an actor who has access to the backup‑restore feature—typically a trusted administrator or a user with sufficient privileges—to supply a malicious archive that triggers the symlink traversal during restoration. Successful exploitation results in remote code execution with root privileges on the host running the Docker container.