---
title: "CVE-2026-27969: Vitess users with backup storage access can write to arbitrary file paths on restore"
url: https://erroneo.us/security/cve/CVE-2026-27969/
description: "CVE-2026-27969 (vitess.io/vitess (Go)): Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone…"
type: vulnerability-record
section: "Security Digest"
date_published: 2026-02-26
date_modified: 2026-02-27
publisher: erroneo.us
author: erroneo.us Security Desk
cve: "CVE-2026-27969"
kev: false
cvss: 9.3
epss: 0.00619
license: All rights reserved. Quote with attribution and a link.
---

# CVE-2026-27969: Vitess users with backup storage access can write to arbitrary file paths on restore

**Signal:** Critical, preconditions apply. Severe if exploited, but exploitation needs conditions that may not apply to you. (Computed from CISA KEV, EPSS and CVSS; not an editorial verdict.)

## Should you act?

- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 0.6% , percentile 49: FIRST’s model estimates a 0.6% chance of exploitation activity in the next 30 days, higher than 49% of all scored CVEs (low). EPSS is a probability, not a verdict.
- Needs an account (high (admin)). Exposure depends on who can log in.
- Only applies if your dependency tree includes vitess.io/vitess (Go) >= 0.23.0-rc1, < 0.23.3, fixed in 0.23.3 ; vitess.io/vitess (Go) < 0.22.4, fixed in 0.22.4 . Check your lockfile, including transitive dependencies.

## What it is

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location (e.g. an S3 bucket) can manipulate backup manifest files so that files in the manifest — which may be files that they have also added to the manifest and backup contents — are written to any accessible location on restore. This is a common path traversal security issue. This can be used to provide that attacker with unintended/unauthorized access to the production deployment environment — allowing them to access information available in that environment as well as run any additional arbitrary commands there. Versions 23.0.3 and 22.0.4 contain a patch. No known workarounds are available.

## Affected packages

- Go `vitess.io/vitess` >= 0.23.0-rc1, < 0.23.3 → fixed: 0.23.3
- Go `vitess.io/vitess` < 0.22.4 → fixed: 0.22.4

## Affected products (CVE record)

- vitessio vitess: < 22.0.4, >= 23.0.0, < 23.0.3

## Severity

- GitHub_M CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H`
- GitHub CVSS 4.0: 9.3 `CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:H/VI:H/VA:L/SC:L/SI:H/SA:H`

## Exploitation

- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none , automatable no , technical impact total .
- FIRST EPSS (model of 2026-10-21): 0.62% probability of exploitation activity in the next 30 days; percentile 49.

## Sources

- [GitHub Advisory GHSA-r492-hjgh-c9gw](https://github.com/advisories/GHSA-r492-hjgh-c9gw)
- [CVE.org record CVE-2026-27969](https://www.cve.org/CVERecord?id=CVE-2026-27969)
- [NVD entry CVE-2026-27969](https://nvd.nist.gov/vuln/detail/CVE-2026-27969)
- [github.com](https://github.com/vitessio/vitess/security/advisories/GHSA-r492-hjgh-c9gw)
- [github.com](https://github.com/vitessio/vitess/pull/19470)
- [github.com](https://github.com/vitessio/vitess/commit/c565cab615bc962bda061dcd645aa7506c59ca4a)
- [owasp.org](https://owasp.org/www-community/attacks/Path_Traversal)

---
Source page: https://erroneo.us/security/cve/CVE-2026-27969/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt