Path-traversal takeover flaw in smart-home Home Assistant: CVE-2026-64825 — update to 2026.6.0

Home Assistant, the popular free software for controlling your home's appliances and IoT devices from one place, has a serious flaw. With CVE-2026-64825, feeding a crafted backup file during initial setup or a backup restore lets an attacker write an arbitrary file anywhere on the device and, ultimately, take it over. No login is required, and it is rated 9.3 (Critical).

The developers have shipped the fix in Home Assistant 2026.6.0; every version before it is affected. This is especially dangerous on "Home Assistant OS" and "Supervised" installs (e.g. on a Raspberry Pi), where the software runs with administrator (root) privileges. Below we walk through what happens and whether your setup is at risk.

Who targets this, and why

The people who exploit this are attackers who find, over the network, a Home Assistant that is mid-setup or in the middle of a backup restore for a server migration. Before setup completes, a Home Assistant has no owner account yet and can accept a backup upload from outside. A freshly launched device, or one being restored during a move, is the prime moment to be targeted.

The attacker submits a crafted file whose name field holds a forbidden location starting with "/" (an absolute path), and writes a file anywhere on the device. What should only ever land in the designated backup folder can now escape that limit — the core of the flaw. Because the write location is attacker-chosen, overwriting a config or script that runs at startup leads to code execution, i.e. takeover.

The damage isn't limited to "losing control of your appliances." Home Assistant ties into door locks, security cameras, indoor sensors, and lighting — things that touch daily life directly. A takeover can mean spying on camera feeds, locking or unlocking doors, and pivoting to the PCs and phones on the same home network. On root-running installs in particular, the whole device can be fully commandeered. That is why the version check and update below should be done promptly.

What happens (the mechanism)

This is a "path traversal (directory traversal)" flaw. Path traversal is a technique where an attacker slips "move up a level" trickery into the part that specifies where a file is saved, forcing reads or writes in places that should be off-limits.

Home Assistant has a backup feature that saves and restores your whole configuration. Inside a backup is a management file called backup.json that summarizes its contents. If an absolute path is written into that file's "name" field, the restore process ignores the intended backup-folder limit and unpacks files straight to the specified location. The result is an arbitrary file write anywhere on the device's filesystem.

On the easy-to-use "Home Assistant OS" and "Supervised" formats, the software runs with administrator (root) privileges. Being able to write anywhere as root means overwriting critical system files or planting a script that runs at startup — which leads all the way to full control of the device. No login is required, and the abuse of a legitimate "restore from backup" action is what makes this flaw so awkward.

Is my setup affected? (Quick reference)

Whether you're affected comes down to your Home Assistant version. Find it under Settings → System → General, or from the lower-left menu. Match it against the table below.

The riskiest cases are Home Assistant exposed directly to the internet, and instances about to be set up or restored to a new server. If yours is already configured and only reachable from your home network, the exploit window is narrow — but with a fix out, updating early is the safe move.

What to do right now

The fix is to update Home Assistant to 2026.6.0 or later. If there's an update notice in the admin, apply it there (official update guide). On "Home Assistant OS," check Settings → System → Updates for both the core and OS updates. Afterward, confirm the version reads 2026.6.0 or later.

If you can't update immediately, or you're about to set up or restore, a solid stopgap is to not expose Home Assistant directly to the internet. If you need remote access, keep it behind a VPN or a trusted relay so the setup screen and restore feature can't be reached from outside. When restoring, also avoid loading backup files from unknown sources.

As of publication, there is no report of this flaw being used in real attacks and no listing on the U.S. CISA catalog of actively exploited vulnerabilities (KEV). Still, Home Assistant is widely used worldwide, and once a fix ships the technique is easier to infer. Internet-exposed and about-to-be-launched setups should update fastest. It's worth also checking the vendor's security page.

FAQ

Summary

Home Assistant, the popular software for controlling home appliances and IoT devices, has a 9.3-rated flaw, CVE-2026-64825. During initial setup or backup restore, an absolute path planted in a crafted backup's name field can write a file anywhere on the device and lead to takeover. No login is required, and impact is largest on root-running "Home Assistant OS" / "Supervised" installs.

The fix is to update to 2026.6.0 or later. Also stick to the basics: don't expose Home Assistant directly to the internet, and don't restore backups of unknown origin. No real-world attacks are confirmed yet, but because this platform ties together devices that touch daily life, don't put the update off.

Sources

• ▸ NVD - CVE-2026-64825 (Home Assistant Core path traversal / arbitrary file write)
• ▸ Home Assistant - Security page
• ▸ Home Assistant - Release notes (fix 2026.6.0)
• ▸ Home Assistant official site
• ▸ Related: tracker of actively exploited vulnerabilities, CISA KEV (Japanese, this site)