CVE-2026-19585— Go-getter vulnerable to a path traversal in S3/GCS directory download handling
Quick assessment
Affected
HashiCorp Shared library
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
HashiCorp go-getter 版本低于 1.8.10 以及 go-getter/v2 版本低于 2.2.5 的软件中存在路径遍历漏洞。在从 S3 和 GCS 下载目录时，攻击者可利用此漏洞将文件写入非预期目标路径，从而可能导致非法文件覆盖。该漏洞（CVE-2026-19585）已在 go-getter 1.8.10 和 go-getter/v2 2.2.5 版本中得到修复。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1041 · Exfiltration Over C2 Channel
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19585
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Go-getter vulnerable to a path traversal in S3/GCS directory download handling
Source: CVE Program / CVE List V5
Vulnerability Description
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| HashiCorp | Shared library | 1.0.1 ~ 2.2.5 | - |
|
II. Public POCs for CVE-2026-19585
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19585
请登录查看更多情报信息。
Other References for CVE-2026-19585 (1)
IV. Related Vulnerabilities
Same product: Shared library
-
CVE-2026-88922
Go-getter vulnerable to a privilege escalation issue in its -
CVE-2026-14362
Denial of service via crafted push/pull gossip message in me -
CVE-2026-8052
Nomad's exec2 task driver vulnerable to arbitrary file read/ -
CVE-2026-0969
Arbitrary code execution in React server-side rendering of u -
CVE-2025-8959
HashiCorp go-getter Vulnerable to Arbitrary Read through Sym
Same vendor: HashiCorp
-
CVE-2026-89322
Vault ACL Policy Evaluation May Allow Bypass of Deny Restric -
CVE-2026-105820
Vault ACL Policy Cache Vulnerable to Cross-Namespace Policy -
CVE-2026-105816
Vault Vulnerable to Arbitrary Code Execution via Plugin Cata -
CVE-2026-105818
Vault PKI ACME Issues Certificate With Unvalidated SANs -
CVE-2026-88922
Go-getter vulnerable to a privilege escalation issue in its
Same weakness: CWE-22
-
CVE-2026-107377
datamodel-code-generator: Protobuf weak-import path traversa -
CVE-2026-102783
Joomla Extension - balbooa.com - Path Traversal in image pre -
CVE-2026-107466
Flatpak-builder: local file exfiltration via `file -
CVE-2026-85490
Brocade ASCG <3.5.0路径遍历漏洞致远程代码执行 -
CVE-2026-85487
Brocade ASCG<3.5.0路径穿越致任意文件操作
V. Comments for CVE-2026-19585
No comments yet