Bug 2548039 (CVE-2026-19585)
| Summary: | CVE-2026-19585 github.com/hashicorp/go-getter: go-getter: arbitrary file write via path traversal in S3 and GCS directory downloads | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | cahl, crizzo, eborisov, gbenhaim, lball, ljawale, msilmser, ngough, niyer, twaugh, veshanka |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in go-getter. A remote attacker can exploit a path traversal vulnerability to write files outside of the intended target directory during directory downloads from Amazon Simple Storage Service (S3) or Google Cloud Storage (GCS). By supplying specially crafted file paths within a remote storage bucket, an attacker can overwrite arbitrary files on the recipient system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2548471, 2548472, 2548473, 2548474, 2548475, 2548477, 2548478, 2548476 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2026-10-08 15:58:49 UTC
|