Medium severity · published Oct 8, 2026
CVE-2026-19585
Go-getter vulnerable to a path traversal in S3/GCS directory download handling
5.3
CVSS
0.2%
EPSS
No
On KEV
Description
HashiCorp go-getter versions before 1.8.10 and go-getter/v2 versions before 2.2.5 are vulnerable to path traversal during S3 and GCS directory downloads, which may allow files to be written outside the requested destination. This vulnerability (CVE-2026-19585) is fixed in go-getter 1.8.10 and go-getter/v2 2.2.5.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
Required
Confidentiality
None
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 11% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SL
Shared library · HashiCorp
1.0.1 before 2.2.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-19585
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-19585
discuss.hashicorp.com
https://discuss.hashicorp.com/t/hcsec-2026-44-go-getter-vulnerable-to-a-path-traversal-in-s3-gcs-directory-download-handling/77819
More from Shared library
8.8
CVE-2026-0969
Arbitrary code execution in React server-side rendering of untrusted MDX content
6.7
CVE-2026-88922
Go-getter vulnerable to a privilege escalation issue in its archive decompression handling
6.0
CVE-2026-8052
Nomad's exec2 task driver vulnerable to arbitrary file read/write on client host through symlink attack
4.9
CVE-2026-14362
Denial of service via crafted push/pull gossip message in memberlist