Detections
Analytics
Alpine: multiple borgbackup packages: security update to 1.4.5-r0
medium Tenable Self-Hosted Container Security Plugin ID 476160
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- borgbackup is an opensource, deduplicating archiver with compression and authenticated encryption. Prior
to 1.4.5 and 2.0.0b22, extracting a malicious archive can follow a symlinked parent path or resolve
embedded dot-dot path components and delete or overwrite files outside the extraction directory. A crafted
slave hardlink can also use an attacker-controlled hardlink source outside the extraction directory and
hard-link that file into the restored tree, disclosing its contents. Creating the malicious archive
requires repository access and, for encrypted or authenticated repositories, the Borg key and passphrase;
a victim must then extract the archive. This issue is fixed in versions 1.4.5 and 2.0.0b22.
(CVE-2026-62268)
Solution
Update the borgbackup library and its related packages to version 1.4.5-r0 or later.See Also
Plugin Details
Severity: Medium
ID: 476160
Version: Revision 1.2
Type: Local
Published: 10/19/2026
Updated: 11/6/2026
Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: Low
Score: 3
Percentile: 23.82
CVSS v2
Risk Factor: High
Base Score: 7.5
Temporal Score: 5.5
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS Score Source: CVE-2026-62268
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
CVSS v4
Risk Factor: Medium
Base Score: 5.3
Threat Score: 1.7
Threat Vector: CVSS:4.0/E:U
Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability Information
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 7/25/2026
Reference Information
CVE: CVE-2026-62268