[GHSA-5hxg-r395-fqxx] Home Assistant Core before 2026.6.0 contains a path...

[PercevalFox]

Updates

• Affected products
• CVSS v3
• CVSS v4
• Summary

Comments
This advisory is unreviewed and has no package mapping, so it does not surface to users of the affected package.

The repository home-assistant/core publishes the PyPI package homeassistant (declared in pyproject.toml; PyPI project metadata links back to the same repository).

Note on the version boundary: the fix commit (567fe858, PR #172368) landed on dev and was cherry-picked onto the release branch as 7e178efe63. Resolving the fixed version from git tag --contains on the original SHA gives 2026.7.0, which is wrong. I checked the published wheels instead.

In homeassistant/components/backup/util.py:

• 2026.1.0 through 2026.5.4 pass data["name"] straight into AgentBackup with no validation
• 2026.6.0 onward derive safe_name via PureWindowsPath(name).name and raise InvalidBackupFilename when it differs, with a matching guard in backup.py rejecting candidate paths outside the backup directory

I checked all 35 stable 2026.x releases; the transition occurs exactly once, at 2026.6.0. This matches the "before 2026.6.0" wording in the description and the release tag already listed in the references.

Proposed range: introduced 0, fixed 2026.6.0.

The CVSS v4 vector was rewritten to omit the trailing Not Defined (X) metrics, which the form's validator rejects. Semantically identical per the CVSS v4.0 specification, same score (9.0 / Critical), no change to the severity assessment. CVSS v3 left untouched.

The advisory also had no title. The proposed one follows the database's naming convention and reflects the existing CWE-22 classification.

[advisory-database]

Hi @PercevalFox! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!