CVE-2026-61625: VictoriaMetrics vmrestore: Path traversal via crafted backup part names escapes restore root

The VictoriaMetrics vmrestore utility does not validate backup part path components before writing restored files to the local filesystem. An attacker who can provide or modify a backup source can craft object names containing .. path components that cause vmrestore to write files outside the intended -storageDataPath restore root, subject to the permissions of the vmrestore process.