Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/master_key.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 11 Nov 2026 22:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Portabase is a database backup and restore tool for PostgreSQL, MySQL, MsSQL, MariaDB, Firebird SQL, SQLite, MongoDB, Redis, Files and Docker Volume. Prior to version 1.21.2, a path traversal in the TUS upload webhook handler (app/api/tus/hooks/route.ts) allowed an unauthenticated attacker to overwrite arbitrary files under the private data directory, including /data/private/keys/master_key.bin (the AES-256-GCM master key). This issue has been patched in version 1.21.2. | |
| Title | Portabase: Unauthenticated path traversal in TUS webhook overwrites AES-256-GCM master key | |
| Weaknesses | CWE-22 CWE-306 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-11-11T21:51:23.105Z
Reserved: 2026-07-29T15:07:24.992Z
Link: CVE-2026-67449
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-11-11T22:17:28.257
Modified: 2026-11-11T22:17:28.257
Link: CVE-2026-67449
Redhat
No data.
OpenCVE Enrichment
No data.