Bug 2548039 (CVE-2026-19585) - CVE-2026-19585 github.com/hashicorp/go-getter: go-getter: arbitrary file write via path traversal in S3 and GCS directory downloads
Summary: CVE-2026-19585 github.com/hashicorp/go-getter: go-getter: arbitrary file writ...
Keywords:
Status: NEW
Alias: CVE-2026-19585
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2548471 2548472 2548473 2548474 2548475 2548477 2548478 2548476
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-08 15:58 UTC by OSIDB Bzimport
Modified: 2026-10-09 10:58 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-08 15:58:49 UTC 
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
Note You need to log in before you can comment on or make changes to this bug.