Security concern: --delete option for restic restore? #93

New Issue

2026-07-22T18:26:21Z

Apfelwurm commented

2026-07-22 18:26:21 +00:00

Hey together,
because of the nice "little" Wordpress problem recently, we are currently sitting together and are restoring snapshots for wp instances. While thinking about in which ways persistence could be preserved even after a restored backup, i thought about the following scenario:

In php applications, there are often autoload mechanisms for plugins and some other parts of modular code (which for sure is going to be the case also in other applications), and so planting executable code for attackers in these spaces is a common practice.

Now to the problem:
Currently it seems, we are calling the restic restore without the delete parameter, which means, when i did not miss anything, that if a file exists in destination but did not exist in the snapshot, it remains untouched.
Which means, any maybe arbitrary additionally placed php file, will stay in the instance in this case, which would be a concerning security risk.

Is this behavior intentional? I think we should change this that --delete is a default behavior

https://restic.readthedocs.io/en/v0.19.1/050_restore.html seems to support what i am thinking.

Hey together, because of the nice "little" Wordpress problem recently, we are currently sitting together and are restoring snapshots for wp instances. While thinking about in which ways persistence could be preserved even after a restored backup, i thought about the following scenario: In php applications, there are often autoload mechanisms for plugins and some other parts of modular code (which for sure is going to be the case also in other applications), and so planting executable code for attackers in these spaces is a common practice. Now to the problem: Currently it seems, we are calling the restic restore without the delete parameter, which means, when i did not miss anything, that if a file exists in destination but did not exist in the snapshot, it remains untouched. Which means, any maybe arbitrary additionally placed php file, will stay in the instance in this case, which would be a concerning security risk. Is this behavior intentional? I think we should change this that --delete is a default behavior https://restic.readthedocs.io/en/v0.19.1/050_restore.html seems to support what i am thinking.

Apfelwurm added the question label 2026-07-22 18:26:21 +00:00

moritz was assigned by Apfelwurm

2026-07-22 18:26:21 +00:00

Apfelwurm referenced this issue

2026-07-22 18:41:23 +00:00

make --delete in restic restore detault behaviour #94

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coop-cloud/backup-bot-two#93