CVE-2026-124029

Kopia through 0.23.1 contains a path traversal vulnerability in copyDirectoryContent that allows users with repository write access to escape the restore directory via crafted entry names. An attacker can create snapshots whose directory manifest entries are named '..', so victims restoring with default options write attacker-chosen content outside the restore directory.

The ability to write files outside the restore directory can lead to overwriting system or configuration files and potential code execution. The risk affects environments where multiple users have write access to the Kopia repository.

Update Kopia to a version containing the fix. Restrict repository write access to trusted users and verify snapshots before restoring.