BorgBackup 1.2.2 → 1.4.5
13 releases · 0 breaking changes · 4 security fixes · 2 advisories fixed
4security0breaking0deprecated3feature1fix
Vulnerabilities fixed by this upgrade
- low CVE-2026-62268 borg extract might modify or disclose out-of-tree files when extracting maliciously crafted archives
- medium CVE-2023-36811 Pre-1.2.5 archives spoofing vulnerability
Breaking changes
None in the release notes.
Security changes
- security Fixes CVE-2026-62268: borg extract might modify or disclose out-of-tree files when extracting maliciously crafted archives in 1.4.5
- security This release includes a security fix plus a fixed upgrade procedure at the top of the change log: in 1.2.6
- security Fixes CVE-2023-36811: Pre-1.2.5 archives spoofing vulnerability in 1.2.5
- security This release includes a security fix plus related upgrade instructions at the top of the change log: in 1.2.5
Every release in between
securityFixes CVE-2026-62268: borg extract might modify or disclose out-of-tree files when extracting maliciously crafted archives
featureborg 1.4.x is kind of a refreshed 1.2 with mostly the same features and behavior, but a few bigger changes that could introduce issues and thus were not suitable for just releasing them as 1.2.x, but rather needed some testing first.
otherShort borg 1.4 overview (from a borg 1.2 perspective):
featureFirst release for the new 1.4-maint branch.
featureborg 1.4 is kind of a refreshed 1.2 with mostly the same features and behavior, but a few bigger changes that could introduce issues and thus were not suitable for just releasing them as 1.2.x, but rather needed some testing first.
otherThis release includes a simplified upgrade procedure at the top of the change log and other fixes:
otherShort borg 1.2 overview (from a borg 1.1 perspective):
otherThis release includes a fixed upgrade procedure at the top of the change log and other fixes:
otherShort borg 1.2 overview (from a borg 1.1 perspective):
securityThis release includes a security fix plus a fixed upgrade procedure at the top of the change log:
otherShort borg 1.2 overview (from a borg 1.1 perspective):
securityFixes CVE-2023-36811: Pre-1.2.5 archives spoofing vulnerability
fixWarning: if you ever used borg recreate or borg rename in a repo, the upgrade instructions will not work, because borg will crash because it can not verify the TAM of some archive(s). In that case, please revert to borg 1.2.4 until a fix is released. Details:…
securityThis release includes a security fix plus related upgrade instructions at the top of the change log:
otherShort changelog summary (changes since borg 1.1):
otherLong changelog (including upgrade and compatibility notes):
otherShort changelog summary (changes since borg 1.1):
otherLong changelog (including upgrade and compatibility notes):