VictoriaMetrics

mirror of https://github.com/VictoriaMetrics/VictoriaMetrics.git synced 2026-07-22 08:40:51 +03:00

Files

Max Kotliar 710c920d60 app/vmrestore: disallow restoring parts outside the configured -storageDataPath directory (#1051 )

A specifically crafted backup source (compromised S3/GCS/Azure bucket) could use `..`
components in object names to write files outside the `-storageDataPath`
directory.

Fix by validating all source parts against the destination directory
before restore begins (restore.go), and adding a defense-in-depth panic
guard in `NewDirectWriteCloser` (fslocal.go).

PR https://github.com/VictoriaMetrics/VictoriaMetrics-enterprise/pull/1051

Co-authored-by: Roman Khavronenko <roman@victoriametrics.com>

2026-06-18 13:21:12 +03:00

actions

app/vmrestore: disallow restoring parts outside the configured -storageDataPath directory (#1051 )

2026-06-18 13:21:12 +03:00

azremote

Spelling and Markdown Standards

2025-08-18 22:46:34 +02:00

backupnames

fix removing storage data dir before restoring from backup (#598 )

2023-07-06 14:16:18 -07:00

common

app/vmrestore: disallow restoring parts outside the configured -storageDataPath directory (#1051 )