Preliminary research

RCE and arbitrary file write in Vitess `vtbackup` via untrusted `MANIFEST` fields

Alex Manson · neurowinter · 18 May 2026

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Vitess vtbackup trusts backup MANIFEST fields when selecting decompression commands and constructing restore paths, before file hashes are checked. An attacker who can alter backup storage can obtain arbitrary file writes and shell execution during a restore.

Record

Researcher

Alex Manson

Published by

neurowinter

Date

18 May 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• backup
• path-traversal
• command-injection
• file-write
• rce
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Alex Manson, first published at the original source. Preserved copies are kept so the citation survives its host.