VictoriaMetrics vmrestore patch fixes path traversal vulnerability

VictoriaMetrics has addressed a medium-severity security issue in its `vmrestore` utility, as detailed in the GitHub Security Advisory database. The vulnerability allowed attackers to exploit crafted backup part names containing `..` path components, enabling files to be written outside the intended `-storageDataPath` restore root. This issue could be exploited by attackers who have write access to the backup storage source, such as an S3 bucket or similar, used by `vmrestore`. The flaw has been patched in versions 1.146.0, 1.136.12, and 1.122.25.

Operators planning to upgrade should ensure their backup storage is properly access-controlled and follows the principle of least privilege, as the security model assumes trusted backup sources. Before upgrading, verify that the backup storage buckets are not exposed to unauthorized write access, as misconfigurations could still leave systems vulnerable even after applying the patch. Additionally, confirm compatibility with the patched versions to avoid disruptions in restore workflows.